SHA-256 hash generator — hash text or compute HMAC-SHA256

How to use the SHA-256 hash generator

1. Enter your input in Text to hash; the hash appears straight away.
2. Set Input is to Text (UTF-8), Hex bytes or Base64 bytes, depending on what you pasted.
3. Choose the Output: hex, HEX or Base64. Base64 is what Subresource Integrity and many APIs expect.
4. For a signature, type the secret into HMAC key (optional); the label changes to HMAC-SHA256.
5. Copy the result and check the Digest length and Input size lines if something does not match.

What it does and when to use it

SHA-256 is part of the SHA-2 family published by NIST. It turns any input into a 256-bit value, shown as 64 hex characters. It is the usual choice today when you need a secure fingerprint: verifying a downloaded installer against the checksum on the publisher’s site, building content-addressed cache keys, checking that a config value has not changed, or debugging code that signs requests.

The HMAC option is especially useful for developers. When a webhook arrives with a signature header, you can paste the raw body and your signing secret here and compare the result with the header.

If an older system asks for MD5, the MD5 hash generator is there, but prefer SHA-256 for anything new. For a longer digest, use the SHA-512 generator, and to see many algorithms side by side, try hash all.

How it works

The tool converts your input to bytes (UTF-8 for text), then runs SHA-256 as defined in FIPS 180-4 using the hash-wasm library, compiled to WebAssembly and loaded in your browser. SHA-256 pads the message, splits it into 512-bit blocks and runs each through 64 rounds of bitwise mixing, updating eight 32-bit state words that together form the final hash. With a key, the tool wraps this in HMAC as defined in RFC 2104. Your text and key never leave the page.

Worked examples

These values come from the tool and match published test vectors.

The standard test. abc hashes to ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, the example value from the SHA-2 standard.

Empty input. With Input is set to Hex bytes and nothing typed, the hash of zero bytes is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. If you ever see this value in a log, something hashed an empty string.

HMAC-SHA256. Text what do ya want for nothing? with key Jefe gives 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843, test case 2 in RFC 4231.

Limits and tips

• Hashing is one-way. You cannot get the text back from a hash.
• Invisible characters count. A newline at the end of copied text changes the whole result.
• Keys are text. The HMAC key is read as UTF-8. If your secret is stored as hex or Base64, decode it first in your own code, or the results will differ.
• Very large inputs belong in the file hash tool, which streams data instead of holding it in a text box.