SHA-256 Hash Generator
Compute SHA-256 cryptographic hashes of any text or file. Client-side via the Web Crypto API — nothing uploaded.
Last updated: April 2026 · Runs in your browser · No sign-up
Verifying a download
Open-source projects publish SHA-256 sums alongside binary releases. After downloading, compute the hash locally and compare to the published value — matching means the file wasn't corrupted in transit or tampered with. Mismatches mean stop and don't run the file.
Passwords: what SHA-256 is not
Hashing a password with plain SHA-256 is insufficient. Attackers use rainbow tables and GPUs to try billions of guesses per second. Use a password-specific KDF (bcrypt, scrypt, Argon2) with a unique salt per password.
Frequently Asked Questions
What is SHA-256 used for?
File integrity verification, password storage (with a salt and a slow KDF like bcrypt), Bitcoin mining, digital signatures, and content-addressable storage (Git uses SHA-1/SHA-256).
Is SHA-256 reversible?
No — it's a one-way function. Given a hash you can't recover the input without brute force. For passwords, always combine SHA-256 with a salt and use a slow hash (bcrypt, Argon2) instead.
How does it compare to MD5 and SHA-1?
MD5 and SHA-1 are broken — practical collisions exist. SHA-256 (part of the SHA-2 family) has no known collision attacks and is the modern standard for integrity and signing.
Can I hash a large file?
Yes. The Web Crypto API streams the file through the hash function; a multi-gigabyte video is no problem, though it takes a few seconds.