Contact

SHA-256 hash generator

SHA-256 turns any input into a fixed 256-bit fingerprint, written as 64 hexadecimal characters, and changing a single character changes the whole hash. Type or paste text to hash it in your browser with the Web Crypto API, as hex or Base64.

Hashed exactly as typed, as UTF-8 bytes. Spaces and line breaks count.

SHA-256 hash (hex)

d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
Algorithm
SHA-256
Input size
43 bytes (UTF-8)43 characters
Hash length
256 bits (32 bytes)64 hex characters

How is a SHA-256 hash calculated?

The text is first turned into bytes with UTF-8, the only encoding the browser's TextEncoder uses, so “abc” is 3 bytes and “é” is 2. FIPS 180-4 then pads those bytes to a whole number of 512-bit blocks and runs each block through 64 rounds of 32-bit operations. The result is always 256 bits: 32 bytes, written as 64 hexadecimal characters or 44 Base64 characters.

SHA-384 and SHA-512 use 1,024-bit blocks, 64-bit words and 80 rounds; SHA-384 is SHA-512 started from different initial values and cut to its first 384 bits. SHA-1 gives 160 bits, but a practical collision was published in 2017 and NIST has said to phase it out by 31 December 2030, so it is here only to match old checksums.

The hash is worked out on this page by the Web Crypto API's crypto.subtle.digest, which browsers offer only on secure (https) pages, so your text is not sent anywhere. The same input always gives the same hash, and FIPS 180-4 calls these functions secure because finding an input for a given hash, or two inputs with the same hash, is computationally infeasible.

bytes = UTF-8(text)
hash = SHA-256(bytes)  →  256 bits = 32 bytes
hex: 2 characters per byte  →  64 characters
Base64: 4 characters per 3 bytes  →  44 characters

What is the SHA-256 hash of an empty string?

Hashes of the empty string and of the FIPS 180 example messages, as lowercase hex
InputAlgorithmHash (hex)
(empty string)SHA-256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
“abc”SHA-256ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
“abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq”SHA-256248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1
(empty string)SHA-38438b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b
“abc”SHA-384cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7
(empty string)SHA-512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
“abc”SHA-512ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
(empty string)SHA-1da39a3ee5e6b4b0d3255bfef95601890afd80709
“abc”SHA-1a9993e364706816aba3e25717850c26c9cd0d89d

How to generate a SHA-256 hash

  1. 1
    Enter your textType or paste up to 1,000,000 characters. Every character counts, including spaces and line breaks.
  2. 2
    Choose the algorithmSHA-256 is the default. Pick SHA-384 or SHA-512 for a longer hash, or SHA-1 only to match an old checksum.
  3. 3
    Choose how to show the hashPick lowercase hex, uppercase hex or Base64 to match the tool or file you are comparing with.
  4. 4
    Copy the hashCopy it from the result, which updates as you type, along with the input's size in bytes.

Frequently asked questions

Can a SHA-256 hash be reversed to get the original text?
No. FIPS 180-4 calls SHA-256 secure because finding an input that gives a particular hash is computationally infeasible. Short or common inputs can still be found by hashing guesses until one matches, so a hash on its own does not hide a password or a phone number.
Is SHA-256 safe for storing passwords?
Not on its own. The OWASP Password Storage Cheat Sheet says fast hashes such as SHA-256 let attackers make large numbers of guesses quickly, and recommends Argon2id, then scrypt, bcrypt for legacy systems, or PBKDF2 where FIPS-140 compliance is required, with a unique salt for every password.
Why doesn't my SHA-256 hash match the one from sha256sum?
The bytes differ, usually by one. echo adds a line break unless you use echo -n, so echo abc | sha256sum hashes 4 bytes, not 3; a different text encoding such as UTF-16, or Windows line endings, also changes the whole hash.
Is SHA-1 still safe to use?
Not for security. Researchers at CWI Amsterdam and Google published the first practical SHA-1 collision in 2017, and in December 2022 NIST announced that SHA-1 should be phased out by 31 December 2030 in favour of SHA-2 or SHA-3.
What is the difference between SHA-256, SHA-384 and SHA-512?
The length of the hash: 256, 384 or 512 bits, shown as 64, 96 or 128 hex characters. SHA-256 works on 32-bit words while SHA-384 and SHA-512 use 64-bit words, and SHA-384 is a shortened SHA-512 with different starting values.

Sources

Built and maintained by CountryDevs. Updated October 2026. Runs in your browser; what you type is not sent to us.

Related tools

See all 73 free tools

Password Generator

Generate strong random passwords in your browser. Custom length, character sets, exclude ambiguous chars.

Base64 Encoder / Decoder

Encode and decode Base64 text. Supports UTF-8, URL-safe variant, and line-wrapping.

JWT Decoder

Decode a JWT to see its header and payload. Runs entirely in your browser — tokens never leave the page.

UUID Generator

Generate v4 UUIDs (1 to 1000 at a time). Lowercase, uppercase, or brace-wrapped. Copy or download.

Need a custom dev tool for your team?

We build internal tools, dashboards, APIs, and SaaS platforms. If you can describe it, we can ship it.

See web app servicesStart a project

Built by CountryDevs · No signup · No ads · We count visits, never what you enter