How to Generate an SHA-256 Hash Online
A hash function turns any input into a fixed-length string that is practically impossible to reverse. The same input always produces the same hash, and changing one character produces a completely different result. SHA-256 always returns 64 hexadecimal characters, regardless of whether you hash one word or a whole file.
SHA-256 of "hello"
= 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
MD5 vs SHA-1 vs SHA-256
| Algorithm | Output length | Status |
|---|---|---|
| MD5 | 128-bit (32 hex chars) | Broken — collisions are trivial |
| SHA-1 | 160-bit (40 hex chars) | Broken — deprecated since 2017 |
| SHA-256 | 256-bit (64 hex chars) | Secure — recommended default |
MD5 and SHA-1 still appear for non-security checks like cache keys or file deduplication, where collision resistance does not matter. For anything touching security — verifying downloads, signing data, storing fingerprints — use SHA-256.
Hashing is not encryption
This trips up a lot of people. Encryption is reversible with a key; hashing is one-way by design. You cannot decrypt a hash back to its input. That is exactly why hashes are used to verify integrity: if two parties compute the same SHA-256 over the same data, they know the data matches without ever sharing the data itself.
A common use: verifying a download
Projects publish a SHA-256 checksum next to a file. After downloading, you hash your copy and compare. If the two strings match, the file arrived intact and untampered. A single flipped bit changes the entire hash, so the check is unforgiving in the right way.
One note on passwords
Do not store passwords with a plain SHA-256. Password storage needs a slow, salted algorithm such as bcrypt, scrypt, or Argon2, which are deliberately expensive to compute and resist brute-force attacks. A fast hash like SHA-256 is the wrong tool there.
Generate a hash in your browser
The free Hash Generator computes MD5, SHA-1, SHA-256, and SHA-512 from text as you type, entirely in your browser. Nothing is sent to a server, so you can hash sensitive strings without them leaving your device.