SHA-2 Hash Generator

1. Type or paste your text into the box, or switch to File and drop in any file: a download, a photo, a document.
2. The SHA-256, SHA-384 and SHA-512 hashes appear straight away and update as you type. Copy the one you need.
3. To check a hash you were given, paste it into Check against a hash. The matching row turns green, or you are told what is likely to be different.

A hash is a fixed-length fingerprint of the exact bytes you put in. The same input always gives the same hash, and changing a single character gives a completely different one. That is why hashes are used to confirm a file arrived intact, to spot changed data, and inside things like TLS certificates and Bitcoin.

Text is hashed as UTF-8, the encoding used by almost every website, programming language and command-line tool, so the result matches what they produce for the same text. SHA-224, SHA-512/224 and SHA-512/256 are under Fine-tune if you need them.

Software sites often list a SHA-256 checksum next to the download link. Checking it proves your copy is complete and is the exact file the publisher released.

The number in the name is the length in bits. Every hash from one variant is the same length, whether you hash one letter or a 10 GB file, so the length tells you which variant a hash came from.

Hex uses two characters per byte, which is why a 32-byte SHA-256 hash is 64 characters long. Base64 packs the same bytes into fewer characters and usually ends in =. A 40-character hash is SHA-1 and a 32-character one is MD5, not SHA-2; for SHA-1, use the SHA-1 Hash Generator.

Nearly always because the bytes being hashed are not quite the same, even though the text looks identical. Here is what small, invisible differences do to the SHA-256 of hello world:

The most common trap is the line break. echo "hello world" | sha256sum hashes the text plus a line break, so it gives a948904f…, not b94d27b9…; echo -n leaves it out. Likewise, hashing a text file usually includes the line break at the end of the last line, while pasting its contents may not.

If you are checking a file, hash the file itself rather than pasting its contents: copying text can change line breaks and invisible characters. And if a downloaded file does not match, it is a different or damaged file. Download it again from the official site rather than using it.

If you are checking a hash someone gave you, use whichever one they published; the length tells you which. If you are choosing, SHA-256 is the standard choice. It is what download pages, certificates, Bitcoin and most APIs use, and it is far beyond the reach of any known attack.

• SHA-256: the default for checksums, file fingerprints and signatures. Shortest common hash that is still considered fully secure.
• SHA-384: a shortened SHA-512. Common in TLS certificates, government systems and the integrity attribute websites use to check scripts (sha384-…).
• SHA-512: the longest hash. Often just as fast as SHA-256 on 64-bit computers, though SHA-256 wins on processors with built-in SHA-256 instructions. Pick it when a system asks for it or you want the largest safety margin.

All three come from the same SHA-2 family and are equally trustworthy for everyday use. A longer hash is not “more correct”, only harder to attack in theory, and SHA-256 is already strong enough that the difference rarely matters.

No. Hashing is not encryption: there is no key and no way to run it backwards. A 64-character SHA-256 hash can stand for a single word or a whole film, so the original simply is not in it.

What sites that claim to “decrypt” SHA-256 actually do is look the hash up in a list of hashes of common words and passwords. That works for hello world or password123, and never for anything long or random. It is also why passwords should not be stored as plain SHA-256: they are fast to compute, so guesses can be tested by the billion. Websites should use a slow password hash such as Argon2id, scrypt or bcrypt instead.

Similarly, an API that asks for an “HMAC-SHA256” signature wants a hash mixed with a secret key, which a plain hash like the ones above does not include.