SHA-256 Hash Generator
Type text or choose a file to get its SHA-256 hash. Switch on HMAC to sign a message with a secret key, as webhook and API signatures do.
Add this calculator to your website
Copy the code and paste it into your page's HTML. It's free; please keep the credit link.
Where SHA-256 is used
SHA-256 belongs to the SHA-2 family published by NIST in FIPS 180-4. It secures TLS certificates and HTTPS, signs software and Git commits (in SHA-256 repositories), proves file integrity in package managers and Docker image digests, and links blocks in Bitcoin.
To verify a webhook, compute HMAC-SHA256 over the raw request body with your signing secret and compare it with the signature header. Use the exact bytes you received: re-serialising the JSON first changes spacing and breaks the match.
Hash lengths
| Algorithm | Bits | Hex characters | Status |
|---|---|---|---|
| MD5 | 128 | 32 | Broken (checksums only) |
| SHA-1 | 160 | 40 | Broken (checksums only) |
| SHA-256 | 256 | 64 | Secure |
| SHA-384 | 384 | 96 | Secure |
| SHA-512 | 512 | 128 | Secure |
Frequently asked questions
How long is a SHA-256 hash?
256 bits: 64 hexadecimal characters, or 44 characters in Base64. The length is the same whether the input is one letter or a 4 GB file.
What's the difference between SHA-256 and HMAC-SHA256?
SHA-256 hashes the data alone, so anyone can recompute it. HMAC-SHA256 mixes in a secret key (RFC 2104), so only someone with the key can produce or check it. Stripe, GitHub and Slack webhooks sign their payloads this way.
Is SHA-256 good for storing passwords?
Not on its own: it's designed to be fast, so attackers can test billions of guesses per second. Use a password hashing function such as Argon2id, bcrypt or scrypt instead.
Is what I paste sent to a server?
No. This tool runs entirely in your browser with JavaScript and the built-in Web Crypto API. Nothing you type, paste or open is uploaded or stored.