Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
The workhorse of modern hashing
SHA-256 belongs to the SHA-2 family and returns a 256-bit digest β 64 hexadecimal characters. Hashing abc gives ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. It is the default choice for TLS certificates, code signing, blockchain proof-of-work, JWT signatures and file checksums, and no practical collision has ever been published against it.
Use SHA-256 whenever you need an integrity fingerprint or the base of a signature. Compared with SHA-512, SHA-256 is faster on 32-bit hardware and produces a shorter digest that is easier to paste into manifests, while SHA-512 offers a larger security margin. Neither is ideal for passwords β those need a deliberately slow function such as bcrypt, scrypt or Argon2.
How to compute a SHA-256 hash
- Type or paste the input β the 64-character digest is recomputed as you type.
- Read the digest, its length and the hashing time below the field.
- Paste an expected SHA-256 to confirm it matches.
- Copy the value into your checksum file or signature.
Frequently asked questions about SHA-256
How long is a SHA-256 hash?
64 hexadecimal characters β 256 bits β regardless of the input size.
Is SHA-256 safe?
Yes. No practical collision or preimage attack is known; it is the recommended general-purpose hash.
Should I hash passwords with SHA-256?
No. It is too fast, so brute force is cheap. Use bcrypt, scrypt or Argon2 with a salt and a work factor instead.
Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
