Input Text
Generated Hashes
Hash text with SHA-256 or SHA-512 and get the hex digest. Use it for checksums and for comparing against a value someone sent you. For storing passwords, use bcrypt or Argon2 instead.
The default. It produces a 256-bit digest (64 hex characters) and is what TLS certificate signatures, Docker image digests and most webhook signatures use. Pick it unless a spec names another algorithm.
Same family, 512-bit digest (128 hex characters). It is often faster than SHA-256 on 64-bit CPUs because it works on 64-bit words, and some standards require it. For ordinary integrity checks it adds no meaningful safety.
SHA-256:
d2d2d2... (64 hex characters)Compare a digest against the one published with a file or sent alongside a payload to confirm nothing changed in transit. Upload File reads the file as text, so hash binary downloads such as a .zip with sha256sum instead.
SHA is too fast for passwords. A GPU can try billions of SHA-256 guesses a second. Use bcrypt or Argon2, which are slow on purpose and salted.
Anyone can compute a plain hash, so it proves nothing about who produced it. Proving the sender needs a secret key, which is what HMAC adds.
const { createHash } = require("node:crypto");
const message = "hello world";
// Node.js: sha1, sha256, sha384, sha512
console.log(createHash("sha256").update(message).digest("hex"));
// b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
// Hash a file without loading it all into memory
// const fs = require("node:fs");
// fs.createReadStream("file.zip").pipe(createHash("sha256").setEncoding("hex")).on("data", console.log);
// Browser / Node 20+: Web Crypto (async, returns an ArrayBuffer)
async function sha256(text) {
const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");
}
sha256(message).then(console.log);Web Crypto supports SHA-1, SHA-256, SHA-384 and SHA-512 but not MD5. It only works on secure contexts (https or localhost).
<?php
$message = 'hello world';
echo hash('sha256', $message), PHP_EOL;
// b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
echo sha1($message), PHP_EOL; // shortcut for hash('sha1', ...)
echo hash('sha512', $message), PHP_EOL;
// Hash a file on disk
// echo hash_file('sha256', 'file.zip');
// Raw bytes instead of hex, then Base64
echo base64_encode(hash('sha256', $message, true)), PHP_EOL;hash_algos() lists every algorithm your build supports, including sha3-256 and blake2b.
import hashlib
message = "hello world"
print(hashlib.sha256(message.encode("utf-8")).hexdigest())
# b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
print(hashlib.sha1(message.encode()).hexdigest())
print(hashlib.sha512(message.encode()).hexdigest())
# Hash a large file in chunks
def sha256_file(path):
h = hashlib.sha256()
with open(path, "rb") as f:
for chunk in iter(lambda: f.read(1 << 20), b""):
h.update(chunk)
return h.hexdigest()
# From the shell: printf 'hello world' | shasum -a 256SHA-1 gives you 160 bits. SHA-256, SHA-384 and SHA-512 are the SHA-2 family, with output sizes matching their names and a wider internal state. On 64-bit CPUs SHA-512 is often faster than SHA-256, because it works on 64-bit words. Do not use SHA-1 for anything security related. Researchers produced a real collision in 2017 and a chosen-prefix collision in 2020, and browsers and Git have been moving off it since.
Do not store passwords with any of these, SHA-512 included. A SHA hash runs in nanoseconds, and that speed helps the attacker: a GPU can try billions of guesses a second. Passwords need a slow, salted algorithm built for the job, so bcrypt, scrypt or Argon2id. Use plain SHA for checksums, content addressing, deduplication and as a building block inside HMAC and signatures.
This tool follows the specifications below. Read them when you need the exact normative wording, for example to settle an edge case between two implementations.
SHA-1, SHA-256, SHA-384 and SHA-512, computed with the Web Crypto API.
SHA-256 for most purposes: checksums, content addressing, signatures. SHA-1 is broken for collision resistance, so use it only for compatibility with existing systems such as Git.
Yes, for text files. Upload File reads the file as text, so the result matches sha256sum for a plain-text file with the same line endings. For binary files such as a .zip or .iso, run sha256sum (or Get-FileHash on Windows) instead.
No. A GPU can try billions of SHA-256 guesses a second, so a fast hash is easy to brute-force. Use a slow, salted algorithm such as bcrypt, scrypt or Argon2 for passwords.
Yes. The output matches sha256sum and similar commands when the input bytes are identical. Watch trailing newlines: echo adds one and printf does not.
When the hash needs a secret key, use the HMAC generator instead. Hashes often travel Base64-encoded rather than as hex, and the Base64 encoder handles that step.