SHA-256 Hash Generator
Generate the SHA-256 hash of any text or password, with an optional salt and lowercase or uppercase hex output.
100% client-side · Web Crypto API · Your data is never stored or sent
SHA-256 is fast by design, so it is not a safe way to store passwords on its own. For that, use Argon2id, scrypt, bcrypt or PBKDF2.
How SHA-256 Works
SHA-256 pads the message and processes it in 512-bit blocks. Each block is mixed into an internal state of eight 32-bit words through 64 rounds of bitwise operations and additions, and the final state is the 256-bit hash. A tiny change in the input changes about half the bits of the output, and the process cannot be run backwards.
This page uses your browser’s built-in implementation (the Web Crypto API) rather than hand-written code, and you can check it against the published NIST example for abc with one click.
Native Web Crypto
SHA-256 computed by the browser itself, with no third-party script loaded
Live Results
The hash updates as you type, for single or multi-line text
Optional Salt
Add a salt after your text and see exactly how many bytes were hashed
Hex Output
Choose lowercase or uppercase hex, and copy it with one click
Known Test Vector
Check the page against the published NIST result for abc in one click
Nothing Stored
No history, no network requests and no external scripts
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is SHA-256?
SHA-256 is a cryptographic hash function from the SHA-2 family, designed by the NSA and published by NIST in FIPS 180-4. It turns any input into a fixed 256-bit (32-byte) value, usually written as 64 hex characters. The same input always gives the same hash, a one-character change gives a completely different one, and there is no known practical way to find an input for a given hash or two different inputs with the same hash. It is used for software checksums, TLS certificates, digital signatures and Bitcoin.
2. Is SHA-256 secure for password hashing?
Not on its own. SHA-256 is designed to be fast, so an attacker with a graphics card can test billions of guesses per second against a leaked hash. To store passwords, use a deliberately slow function such as Argon2id, scrypt, bcrypt or PBKDF2 with a high iteration count, and a unique random salt for each password. This tool is best for checksums, comparing data and learning.
3. What does the salt do here?
A salt is extra text hashed together with the input, so that identical inputs give different hashes and precomputed lookup tables stop working. This page adds the salt after your text (text + salt) and hashes the result once, so you need the same text, the same salt and the same order to reproduce a hash. A salt is not secret, so store it next to the hash. Salting does not make a single fast SHA-256 hash safe for passwords.
4. Why does my hash differ from another tool’s?
A hash depends on the exact bytes. The usual causes are a trailing space or line break, Windows (CRLF) versus Unix (LF) line endings, a different text encoding (this page hashes the text as UTF-8), and a salt that is placed or written differently. Upper and lower case hex are the same value, only the display differs. The size shown under the result tells you how many bytes were hashed.
5. Can I hash a file with this tool?
No. This tool hashes text that you type or paste. To check a downloaded file, use your operating system’s checksum command, for example sha256sum on Linux, shasum -a 256 on macOS or Get-FileHash in PowerShell.
6. Can a SHA-256 hash be reversed?
A hash cannot be decoded, because it throws information away. But short or predictable inputs, such as common passwords, can be found by guessing and hashing every candidate, which is exactly what attackers do. The hash of a long random value is not practically reversible.
7. How is SHA-256 different from SHA-1 and from HMAC?
SHA-1 produces a 160-bit hash and is deprecated: researchers produced a practical collision in 2017. SHA-256 has no key, so anyone can compute it, and SHA-256(secret + message) is not a safe way to authenticate a message because of length-extension attacks. To prove a message came from someone who knows a secret, use HMAC.
8. Is my data sent or stored anywhere?
Everything runs in your browser using the Web Crypto API, the page’s content security policy blocks outgoing network requests, and nothing is saved: there is no history, and the only thing kept in local storage is your language choice. Earlier versions of this page loaded a third-party hashing script from a CDN; this version uses only the browser’s built-in implementation and loads nothing external.