CRYPTO.01 SHA-256 HASH

SHA-256 Hash Generator

Text, file, and HMAC inputs share one digest result. Hex, Base64, and checksum comparison remain visible on the first screen, and files stay in the browser.

SOURCE

Input

Waiting for input

DIGEST

SHA-256 digest

Lowercase Hex —

Uppercase Hex —

Base64 —

Base64URL —

Compare a SHA-256 checksum

Waiting for a checksum

§ 01

How to generate and verify SHA-256

Choose an input type

Text hashes a string, File checks a download, and HMAC authenticates a message with a shared secret.

Read the digest

Lowercase Hex, uppercase Hex, Base64, and Base64URL are produced from one calculation.

Compare when needed

Paste a trusted 64-character hexadecimal checksum to compare instantly without case sensitivity.

§ 02

Digests protect integrity, not secrecy

SHA-256 maps any input length to a fixed 256-bit digest. A one-byte change produces a substantially different result, which makes it useful for file checks, content addressing, and digital-signature workflows.

A digest does not provide confidentiality. Anyone with the same input can calculate it; use HMAC to authenticate a shared secret and an established encryption scheme to hide content.

§ 03

Comparing common hash uses

Scheme

Purpose

Recommendation

SHA-256

File and content integrity

Modern general-purpose digest

HMAC-SHA256

Keyed message authentication

API signatures and webhook verification

MD5

Legacy checksum compatibility

Not for security-sensitive use

Password hash

User password storage

Use Argon2id, scrypt, or bcrypt

§ 04

Calculate SHA-256 in code

const bytes = new TextEncoder().encode('hello');
const digest = await crypto.subtle.digest('SHA-256', bytes);

§ 05

Frequently Asked Questions

Q1Is SHA-256 encryption?

No. SHA-256 is a one-way hash function with a fixed 256-bit digest; it cannot be decrypted with a key to restore the original content.

Q2Can I store passwords with plain SHA-256?

That is not recommended. Password storage should use a salted, cost-adjustable algorithm such as Argon2id, scrypt, or bcrypt to resist high-speed guessing.

Q3What is the difference between a hash and HMAC-SHA256?

A plain hash depends only on the message. HMAC also requires a shared secret and can authenticate message integrity and key possession.

Q4Why can a file digest verify a download?

Identical bytes produce an identical digest. Comparing against a checksum from a trusted publisher can reveal corruption or replacement.

Q5Is the file uploaded?

No. The browser File API reads the bytes and Web Crypto calculates the digest in local memory without a server request.