How to use SHA-256 Hash
- Type text, or switch to File and choose the file to fingerprint.
- Copy the SHA-256 from the highlighted row (hex by default; switch to HEX or Base64).
- To verify a download, paste the site's SHA-256 into Compare and watch for the green match.
- For a signed request, tick HMAC with a key and enter the secret.
Why use SHA-256 Hash
SHA-256 first
The row you came for sits at the top, with Copy; MD5, SHA-1, SHA-384 and SHA-512 follow.
Files up to 256 MB
Hashed by your browser with Web Crypto; nothing is uploaded.
Checksum check
Case-insensitive comparison with the hash a download page publishes.
HMAC-SHA256
The signature scheme of most webhooks and APIs, with your key.
About this tool
SHA-256 is the hash you meet everywhere now: file checksums, Git and Bitcoin, TLS certificates, JWT signatures (HS256), webhook signatures. It produces 256 bits, written as 64 hex characters, and no practical way is known to make two different inputs share one. That makes it the right choice for checking a download and for signing with a key.
This page uses the browser's own Web Crypto implementation, so the result is exact and the data never leaves your device. The hash of text is of its UTF-8 bytes exactly as typed; the hash of a file is of its bytes, the same figure sha256sum or Get-FileHash would print.
Frequently asked questions
Is the SHA-256 here the same as sha256sum on Linux?
Yes for files. For text, make sure a trailing line break matches: sha256sum of a file made with echo includes the newline that echo adds.
Hex or Base64?
Hex (64 characters) is what checksums and Git use; Base64 (44 characters) appears in Subresource Integrity (sha256-…) and some APIs. Both are the same bytes.
Can SHA-256 be reversed?
No. It is one-way; the only way to find an input is to guess it, which is why short passwords hashed with plain SHA-256 are still crackable by guessing.
How is HMAC-SHA256 different?
It mixes a secret key into the hash, so only someone with the key can produce or check it. Use it to verify webhooks and sign API calls.
Is the file uploaded?
No. It is read and hashed by your browser.