SHA-256 Hash Generator

Calculate cryptographic SHA-256 message digests from text and Unicode strings using hardware-accelerated Web Crypto API. Includes full UTF-8 compliance, hex case formatting, and instant clipboard copying.

Input Text / String UTF-8 Unicode Standard
SHA-256 Hexadecimal Digest 0 Bytes
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
FIPS 180-4 Compliant
256 bits (32 bytes / 64 hex characters) • Hardware accelerated Web Crypto

What is SHA-256?

SHA-256 (Secure Hash Algorithm 256) is a member of the SHA-2 family of cryptographic hash functions designed by the United States National Security Agency (NSA) and published by NIST in FIPS PUB 180-4.

SHA-256 takes an input message of arbitrary length and calculates a fixed 256-bit (32-byte) message digest. It is mathematically designed with two essential cryptographic properties:

  • Pre-image Resistance (One-Way): It is computationally infeasible to invert or reverse the hash output back into the original input.
  • Collision Resistance: It is computationally infeasible to find two distinct inputs $x$ and $y$ that produce the identical hash digest: $\text{SHA-256}(x) = \text{SHA-256}(y)$.

Hashing vs. Encryption: Understanding the Difference

Developers occasionally confuse hashing with encryption:

  • Hashing is One-Way: Hashing has no secret keys and cannot be decrypted. It serves as an unforgeable digital fingerprint for integrity verification, digital signatures, and commit identification (such as Git SHA-1/SHA-256 object hashes).
  • Encryption is Two-Way: Encryption requires a key (such as in AES-256-GCM) to transform plaintext into ciphertext, and requires that same key to restore the original plaintext.

Crucial Notice on Password Storage

Do NOT Use Plain SHA-256 for Passwords: Because SHA-256 is designed to verify file and message integrity at maximum speed, modern consumer graphics cards (GPUs) can compute over 10 billion SHA-256 hashes per second. Storing user passwords with raw SHA-256 (even with simple salting) leaves them vulnerable to rapid dictionary attacks. Always use slow, memory-hard algorithms like Argon2id, bcrypt, or PBKDF2 with high iteration counts for password hashing.

Practical Examples

Demonstrating the "avalanche effect": changing a single character alters over 50% of the output bits:

Input: "hello world"
SHA-256: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

Input: "hello world!" (one exclamation added)
SHA-256: 7509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9

Frequently Asked Questions

SHA-256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function published by NIST in FIPS PUB 180-4. It maps input text of any length into a fixed-size 256-bit (32-byte / 64-hexadecimal-character) fingerprint. The function is designed to be deterministic, preimage resistant (one-way), and collision resistant.

Hashing is a one-way mathematical transformation: once text is converted into a hash, it mathematically cannot be decrypted back into the original input. Encryption is a two-way process: data is scrambled using a cryptographic key and can be completely restored using the corresponding decryption key.

SHA-256 was engineered for high-throughput integrity verification (such as file checksums and digital signatures). Modern GPU clusters and ASIC hardware can compute tens of billions of SHA-256 hashes per second. Attackers can quickly crack unsalted or single-round SHA-256 hashes using precomputed rainbow tables. For password storage, use slow, memory-hard key derivation functions like Argon2id, bcrypt, or PBKDF2.

Yes. Text is converted into standard UTF-8 binary bytes using the TextEncoder Web API prior to hashing. Accents (e.g. café), Asian scripts, Arabic, and emojis generate standard RFC-compliant digests matching Linux sha256sum and OpenSSL.