How to generate a SHA-256 hash
- Type or paste text, or switch to File and drop the file you want to check, such as an installer or ISO image.
- The 64-character SHA-256 hash appears at the top of the results.
- Paste the checksum published by the software vendor into Compare. A green "Match" means your file is identical to the one they published.
Why SHA-256?
SHA-256 is part of the SHA-2 family designed by the NSA and standardised by NIST. It produces a 256-bit digest and has no known practical attacks, which is why it is used for TLS certificates, code signing, Bitcoin, software release checksums, Docker image digests, Subresource Integrity and API request signing. If you need one hash for security today, SHA-256 is the safe default.
Verifying a download with SHA-256 protects you against corrupted transfers and, if the checksum comes from a trusted source such as the vendor's HTTPS site, against tampered mirrors. Even a single changed bit produces a completely different hash.
Hashing uses the browser's built-in Web Crypto implementation, which is fast enough for files of hundreds of megabytes. Text is encoded as UTF-8. Your data is processed locally and never sent to a server.
FAQ
What is the SHA-256 hash of "abc"?
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, the official test vector.
How do I check a SHA-256 checksum on my computer?
Linux: sha256sum file. macOS: shasum -a 256 file. Windows PowerShell: Get-FileHash file (SHA-256 is the default).
Is SHA-256 good for storing passwords?
Not on its own. It is too fast, so attackers can test billions of guesses per second. Use bcrypt, scrypt or Argon2 for passwords.