How do I generate a SHA256 hash?

Paste or type your text. The SHA-256 hash appears at once in hex and Base64. Press Copy to use it.

How long is a SHA256 hash?

It is 256 bits: 64 hex characters, or 44 characters in Base64.

Is SHA256 encryption?

No. It is a one-way hash. You cannot get the original text back from it, and there is no key to decrypt it.

It is a SHA-256 hash that also uses a secret key. It proves that a message came from someone who knows the key and was not changed. Enter a key in the HMAC box to calculate it.

Is SHA256 safe for passwords?

Not on its own. It is too fast, so guesses can be tested very quickly. Use bcrypt, scrypt or Argon2 for passwords.

No. The hash is calculated in your browser and your text and key never leave it.

SHA256 Generator: SHA-256 and HMAC Hash Online

Hash any text with SHA-256 and copy the result in hex or Base64. Add a secret key to calculate HMAC-SHA256 for API signatures and webhooks.

What SHA-256 is

SHA-256 belongs to the SHA-2 family, published in 2001. It turns any input into a 256-bit fingerprint, shown as 64 hex characters. It is the standard choice today for checksums, certificates, signatures and blockchains, and no practical attack on it is known.

What this SHA256 generator does

Hash text, hex bytes or Base64 input, with the text encoded as UTF-8.
Hex (lowercase or uppercase) and Base64 output.
HMAC-SHA256. Enter a secret key and the tool gives you the keyed hash used by API signing and webhooks.
Line break options to match the hash of a file: ignore the final line break, or use CRLF.
A compare box that checks the result against a hash you paste.

SHA-256 examples

Input	SHA-256 (hex)
(empty text)	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
abc	ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
hello	2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

HMAC-SHA256

An HMAC mixes a secret key into the hash. Only someone who knows the key can produce the right value, so it proves that a message is genuine and unchanged. Test it with the key key and the text The quick brown fox jumps over the lazy dog. The result must be:

f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Typical uses are the signatures of AWS requests, webhook headers from services such as GitHub and Stripe, and the HS256 algorithm of JSON Web Tokens (see the JWT encoder). Always compare signatures with a constant-time function in your code, not with a plain equality check.

Where SHA-256 is used

TLS certificates and code signing.
Bitcoin, which applies SHA-256 twice to hash blocks and transactions.
Software downloads, which publish a SHA-256 checksum next to the file. Check one with the file hash checker.
Container images. Docker image digests look like sha256:...
Content addressing and cache keys where an accidental clash must be impossible.

SHA-256 or SHA-512?

Both are secure. SHA-512 gives a longer hash (128 hex characters) and is often as fast or faster on 64-bit processors. SHA-256 is smaller and more widely supported. If you need a longer hash, use the hash generator, which shows SHA-384 and SHA-512 too.

SHA-256 and passwords

SHA-256 is strong, but it is fast, so it is the wrong tool for storing passwords. A stolen list of SHA-256 password hashes can be attacked at billions of guesses per second. Use bcrypt or Argon2 (see the bcrypt generator), or PHP password_hash(). Details are in the hash functions guide.

SHA-256 in code

// JavaScript (browser)
const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode("hello"));

// Node.js
require("crypto").createHash("sha256").update("hello").digest("hex");
require("crypto").createHmac("sha256", "key").update("message").digest("hex");

# Python
import hashlib, hmac
hashlib.sha256(b"hello").hexdigest()
hmac.new(b"key", b"message", hashlib.sha256).hexdigest()

// PHP
echo hash("sha256", "hello");
echo hash_hmac("sha256", "message", "key");

# Command line
printf hello | sha256sum         # Linux
printf hello | shasum -a 256     # macOS

Other pages: SHA1 generator, MD5 generator and the hash generator. Your text stays in your browser.

SHA256 Generator

Result