SHA256
Calculate SHA-256 hashes or HMAC-SHA-256 for text using UTF-8, UTF-16, Hex, Base64, and other input encodings. Expand to read more.
Calculate a SHA-256 hash online
SHA-256 is a cryptographic hash function that maps input data to a fixed 256-bit digest. Enter text or encoded bytes, select the input encoding, and output the result as lowercase Hex, uppercase Hex, or Base64. The same bytes always produce the same digest.
A hash is one-way: it is not encryption and cannot be decrypted to recover the original input. SHA-256 is commonly used for integrity checks, digital-signature systems, content identifiers, and comparing data without storing the data itself.
How to calculate SHA-256
- Enter the source text or encoded byte sequence.
- Select the encoding that describes how the input should become bytes.
- Choose Hex or Base64 for the digest representation.
- Enable HMAC and enter a secret key only when keyed authentication is required.
- Calculate and compare the complete output with the expected digest.
For UTF-8 text abc, the SHA-256 digest is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.
Input encoding changes the hash
SHA-256 operates on bytes, not on how characters look. UTF-8, UTF-16LE, Hex, and Base64 can produce different byte sequences from similar-looking input. Hex and Base64 modes interpret the input as encoded bytes rather than hashing the visible characters themselves.
Line endings, trailing spaces, Unicode normalization, and letter case also change the digest. When matching another system, confirm the exact bytes and encoding used on both sides.
SHA-256 is specified by NIST in FIPS 180-4.
SHA-256 and HMAC FAQ
Is SHA-256 secure for passwords?
Do not store passwords with a single fast SHA-256 hash. Password storage should use a dedicated password-hashing or key-derivation scheme with salt and an appropriate work factor.
What is HMAC-SHA-256?
HMAC combines SHA-256 with a secret key to authenticate a message. A plain hash can detect a difference when compared with a trusted value, but it does not prove who created the value.
How do I hash a file instead of text?
Use the SHA-256 File Checksum tool to process local files or URL content without first converting the file into text.