SHA-256 hash generator
Type or paste any text to compute its SHA-256 digest instantly and see live character/byte counts alongside it.
0 characters · 0 bytes
What SHA-256 is
SHA-256 is a member of the SHA-2 family of hash functions, published by NIST in 2001. It takes an input of any length and always produces a 256-bit (64 hexadecimal character) digest. Unlike MD5 and SHA-1, SHA-256 has no known practical collision attacks and remains the workhorse hash function behind much of modern computing infrastructure.
Where SHA-256 shows up
- TLS/SSL certificates use SHA-256 as part of their signature algorithm.
- Git is transitioning its object storage from SHA-1 to SHA-256 for stronger integrity guarantees.
- Bitcoin and many blockchains use SHA-256 (often applied twice) as their core proof-of-work hash function.
- Software distribution — most modern package managers and download pages publish SHA-256 checksums instead of the older MD5.
- Password hashing building blocks — PBKDF2-HMAC-SHA256 is a NIST-approved way to use SHA-256 safely for passwords by iterating it thousands of times; see our note on that in the SHA-256 for passwords guide.
SHA-256 vs SHA-1 vs MD5
All three are general-purpose hash functions, but they differ in output size and current security status. MD5 (128-bit) and SHA-1 (160-bit) both have practical, demonstrated collision attacks and are considered broken for security purposes. SHA-256 (256-bit), part of the newer SHA-2 family, has no such attacks known and is the recommended default for new systems that need a general-purpose cryptographic hash.
Using SHA-256 as a hash calculator
This page doubles as a lightweight SHA-256 calculator: alongside the hex digest, it shows you the character and byte length of your input, which is useful when you're debugging why a hash doesn't match an expected value — a stray trailing newline or an encoding mismatch (UTF-8 vs ASCII) is a common, easy-to-miss cause. For a version of this tool with more calculator-style features (encoding options, combined with a hash comparison field), see our SHA-256 hash generator and calculator.
SHA-256 and salting
Like any general-purpose hash, a bare SHA-256 digest of a secret should be salted if it's protecting anything sensitive. See SHA-256 with salt for append, prepend, and HMAC-based approaches.
Frequently asked questions
Is SHA-256 reversible?
No. SHA-256 is a one-way function. There is no algorithm that reconstructs the original input from the digest alone — the only way to "reverse" it is to guess inputs and check them, which is only feasible against weak, guessable input.
Is SHA-256 good enough for passwords on its own?
On its own, no — it is too fast, making brute-force attacks against stolen hashes cheap. Iterated inside PBKDF2, or replaced entirely with bcrypt/Argon2, it becomes appropriate for password storage.
How long is a SHA-256 hash?
Always exactly 64 hexadecimal characters (256 bits), regardless of how long or short the input text is.