The canonical test vector
Input
abc
Result
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
This digest is published in the FIPS 180-4 test vectors, which makes it a quick way to confirm any SHA-256 implementation.
UUID / Hash Tools
SHA256 Generator
Generate a SHA-256 digest for strings, tokens, and verification workflows.
SHA-256 digest
Understand the format
How SHA256 Generator works
SHA-256 compresses any input into a fixed 256-bit fingerprint that is deterministic, one-way, and extremely sensitive to the smallest change in the input bytes.
The three properties that make a hash useful
A cryptographic hash is deterministic: the same bytes always produce the same 64-character hexadecimal digest. It is preimage resistant: given a digest, there is no practical way to recover the input. And it is collision resistant: no one has found two different inputs that produce the same SHA-256 output, and no attack better than brute force is known against the full function.
It also exhibits the avalanche effect. Change one bit of the input and roughly half the output bits flip. That is what makes a digest a useful integrity check: there is no such thing as a "close" hash, so any corruption, however small, produces a completely unrelated value.
Hashing is not encryption, and not password storage
Encryption is reversible with a key; hashing is not reversible at all. Nothing "decrypts" a SHA-256 digest. What attackers do instead is guess: they hash billions of candidate inputs per second on commodity GPUs and compare the results. Short or predictable inputs are recovered quickly by exactly this method.
That speed is the reason raw SHA-256 is the wrong tool for storing passwords. Password storage needs a deliberately slow, memory-hard function with a unique per-user salt, such as Argon2id, scrypt, or bcrypt. SHA-256 is the right building block for integrity checks, content addressing, HMAC, and digital signatures.
Step by step
How to use SHA256 Generator
- Paste or type the exact text you want to fingerprint.
- Read the 64-character hexadecimal digest from the output panel; it updates as you type.
- Compare it with the expected value character by character, or paste both into a text comparison.
- If two digests differ unexpectedly, check the input for trailing newlines, different line endings, or encoding differences before assuming corruption.
Digests are computed in the browser using the Web Crypto API. Your input is not transmitted, so tokens and internal identifiers can be checked safely.
Worked examples
SHA256 Generator examples explained
The empty input still has a digest
Input
(nothing)
Result
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Every input length maps to exactly 256 bits. Seeing this particular value in a system usually means an empty string was hashed by mistake.
Reference
The SHA-2 family and its neighbours
| Algorithm | Digest size | Hex length | Status |
|---|---|---|---|
| MD5 | 128 bits | 32 characters | Broken for security use; collisions are trivial. |
| SHA-1 | 160 bits | 40 characters | Broken; practical collisions demonstrated in 2017. |
| SHA-256 | 256 bits | 64 characters | Recommended general-purpose default. |
| SHA-512 | 512 bits | 128 characters | Secure; often faster on 64-bit hardware. |
| SHA-3-256 | 256 bits | 64 characters | Secure; different internal construction to SHA-2. |
Practical Guide
How teams use SHA256 Generator
Common use cases
- Hash release artefacts or copied payloads to verify they match across environments.
- Create checksums for support investigations and manual integrity verification.
- Prove that two strings differ when the visible difference is impossible to spot.
Checks before trusting the result
- Hashing is one-way; the original value cannot be recovered from the digest.
- Use a dedicated password-hashing function with a salt for stored credentials, never raw SHA-256.
- Whitespace, line endings, and character encoding are part of the input and change the result completely.
Troubleshooting
Common mistakes and how to fix them
- Digests disagree between a file and a copied string.
- Most text files end with a trailing newline, and Windows uses CRLF where Unix uses LF. Normalise line endings before comparing.
- Hashing a password and storing the result.
- Use Argon2id, scrypt, or bcrypt with a unique salt and current work factors. Fast hashes make offline guessing cheap.
- Comparing digests with a plain string equality check in security-sensitive code.
- Use a constant-time comparison so response timing does not leak how many leading characters matched.
FAQ
SHA256 Generator questions, answered
Can a SHA-256 hash be decrypted?
No. A hash is not encrypted text; it is a one-way digest of arbitrary-length input into 256 bits. So-called reverse lookup sites only search precomputed tables of common inputs.
Is SHA-256 broken?
No. There is no known practical collision or preimage attack against the full function, and it remains a standard choice for signatures, certificates, and content addressing.
Why does the same text hash differently in another tool?
Almost always because of encoding or invisible characters. This page encodes the text as UTF-8 before hashing. A tool that uses UTF-16 or Latin-1, or that appends a newline, will produce a different digest.
What is the difference between SHA-256 and HMAC-SHA-256?
HMAC mixes a secret key into the hashing process, so it proves both integrity and authenticity. A plain digest proves only that the content is unchanged; anyone can compute it.
Does hashing here happen locally?
Yes. The page calls the Web Crypto SubtleCrypto digest API in your browser; the text is never sent anywhere.
Go deeper
Specifications and guides
- Hashes, UUIDs, and When Each One Fits — A concise decision guide for choosing identifiers and fingerprints in web systems.