How to generate SHA-256 and SHA-512 hashes
This hash generator computes SHA-256 and SHA-512 digests of text or files using the Web Crypto API (SubtleCrypto.digest()). Type or paste text to see both hashes update instantly, or drop in a file — an installer, an ISO image, a release archive — to get its checksum and compare it with the one the publisher lists.
Files are read and hashed locally by your browser. They are never uploaded, so you can safely checksum confidential documents or large binaries.
How to use it
- To hash text, type or paste it into the text box. SHA-256 and SHA-512 are shown as lowercase hex.
- To hash a file, choose or drop the file in the file section and wait for the digest to finish.
- Copy the hash, or compare it with a published checksum. If even one character differs, the file is not identical.
| Input | SHA-256 |
|---|---|
hello | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
Hello | 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 |
| (empty) | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
Changing one letter's case produces a completely different hash — the "avalanche effect" that makes hashes useful for detecting changes.
Verifying a download
Many projects publish a SHA256SUMS file or a checksum next to each download. Hash the file you downloaded and compare: a match means the file arrived intact and matches what the publisher hashed. It's also the quickest way to check whether two files are byte-for-byte identical. You can do the same from a terminal:
# macOS
shasum -a 256 file.zip
# Linux
sha256sum file.zip
# Windows PowerShell
Get-FileHash file.zip -Algorithm SHA256A checksum from the same server as the download only proves integrity, not authenticity — an attacker who controls the server can replace both. Signed releases (GPG, Sigstore) protect against that.
Which hash for which job
| Algorithm | Output | Status | Use it for |
|---|---|---|---|
| MD5 | 128 bits | Broken — collisions are trivial | Nothing security-related; not offered here |
| SHA-1 | 160 bits | Broken — practical collisions since 2017 | Legacy compatibility only |
| SHA-256 | 256 bits | Secure | Checksums, content addressing, HMAC, signatures |
| SHA-512 | 512 bits | Secure | Same uses; often faster than SHA-256 on 64-bit CPUs |
Don't store passwords with plain SHA-256. General-purpose hashes are designed to be fast, so attackers can test billions of guesses per second on a GPU. Use a dedicated password-hashing function — Argon2id, scrypt or bcrypt — which is deliberately slow and salted. Likewise, to authenticate a message with a secret key, use HMAC-SHA256 rather than sha256(secret + message).
Hashing in code
// Browser / Deno / Node.js 20+
const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode("hello"));
const hex = [...new Uint8Array(buf)].map(b => b.toString(16).padStart(2, "0")).join("");
// Node.js
require("node:crypto").createHash("sha256").update("hello").digest("hex");
# Python
import hashlib; hashlib.sha256(b"hello").hexdigest()Note that text is hashed as UTF-8 bytes. A trailing newline counts: echo hello | sha256sum hashes hello\n and gives a different result from this tool unless you use echo -n.
Frequently asked questions
Can a SHA-256 hash be reversed?
No. Hash functions are one-way. But short or common inputs can be found by guessing — which is why passwords need slow, salted password-hashing functions instead.
Why isn't MD5 available?
MD5 is cryptographically broken: different inputs with the same MD5 hash can be produced in seconds. The tool deliberately offers only SHA-256 and SHA-512.
Are my files uploaded to compute the hash?
No. The file is read by your browser and hashed with the Web Crypto API on your device. Nothing is transmitted.
Why does my terminal give a different hash for the same text?
Usually a trailing newline. echo adds one; use echo -n or printf to hash exactly the same bytes as the text box.