SHA-256 Generator
SHA-256 Generator encodes the text as UTF-8, hashes those bytes through Web Crypto, and returns 64 lowercase hexadecimal characters. It is useful for deterministic fingerprints and test vectors, but a plain SHA-256 digest does not authenticate the source, protect secrets, or safely store passwords. Every whitespace, normalization, and line-ending difference changes the bytes being hashed.
Runs locally — files stay on your deviceWhat does a SHA-256 match establish?
It establishes that the compared byte sequences produced the same digest, not who supplied them.
A modern digest is not automatically a security protocol
SHA-256 offers strong preimage and collision resistance for current general use, but authentication needs a trusted comparison value, HMAC, or signature.
How it works
TextEncoder creates UTF-8 bytes, crypto.subtle.digest computes SHA-256, and 32 bytes are formatted as hex.
Key concepts
64 hex characters
Two characters represent each of 32 digest bytes.
Canonicalization is external
The page does not normalize Unicode or line endings.
When to use it
- Create a reproducible text fingerprint.
- Verify a documented SHA-256 test vector.
- Compare canonicalized text across systems.
When not to use it
- Do not hash passwords directly.
- Do not call an unkeyed hash a signature.
- Do not expect visually identical Unicode strings always to share bytes.
Worked examples
Known vector
- Input
abc- Expected output
ba7816...15ad
Standard SHA-256 UTF-8 result.
Case change
- Input
ABC- Expected output
Different digest
Case changes bytes.
Composed accents
- Input
Visually similar Unicode forms- Expected output
May differ
No normalization occurs.
Common mistakes
Password storage
Fast unsalted SHA-256 enables guessing. Correction: Use a password KDF.
Comparing noncanonical text
Equivalent-looking forms can differ. Correction: Define canonicalization before hashing.
Trusting a hash from the same source
Both can be replaced. Correction: Authenticate the expected value.
Best practices
- Define exact UTF-8 input and normalization.
- Use HMAC for shared-secret authentication.
- Use digital signatures for public verification.
Related operations and differences
SHA-512 Generator
It returns a longer SHA-2 digest and uses a different internal construction.
HMAC Generator
HMAC combines a hash with a secret key to authenticate data.
Limitations and privacy
- Text only; no file input, canonicalization, salt, password KDF, HMAC, signature, keyed mode, or trust validation.
- Output is lowercase hex.
The entered value is transformed locally in this browser and is not sent to the Toolbox server.
Copying or pasting sensitive output into another service is a separate disclosure decision.
Frequently asked questions
How long is SHA-256 hex?
64 characters.
Is it reversible?
Not feasibly in general, but weak inputs can be guessed.
Does it authenticate text?
No.
Are line breaks included?
Yes.