TK
Developer Tools

SHA-256 Hash Generator

Compute 256-bit SHA-256 hashes for text or files in your browser. The current default for file integrity, TLS certificate fingerprints, container image digests, and most cryptographic uses.

Input
Hashes
Paste text to compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512.

Inputs stay on this device. Every developer tool on TaskKit runs entirely in your browser. Tokens, payloads, and pasted text are not transmitted to TaskKit servers or third parties.

What this tool does

Computes the SHA-256 hash of any text or file in your browser, returning a 64-character hexadecimal digest. SHA-256 is the workhorse of modern cryptographic hashing: 256 bits of output, part of the SHA-2 family (FIPS 180-4), designed by the NSA and published in 2001. After more than two decades of public scrutiny, no practical collision attack on SHA-256 is known. It is the right default for almost any new code that needs a cryptographic hash.

Where SHA-256 is in use

  • TLS certificates. Every HTTPS certificate issued today carries a SHA-256 (or stronger) signature.
  • Container image digests. Docker, OCI, and Kubernetes use SHA-256 to identify images uniquely. The @sha256:abc... notation in image references is exactly this.
  • Bitcoin block hashes and transaction IDs. Bitcoin's proof-of-work is SHA-256 applied twice; every transaction is identified by its SHA-256 digest.
  • Subresource Integrity (SRI). <script integrity="sha256-..."> tells the browser to refuse the script if its hash doesn't match.
  • Software release verification. When a project publishes a download alongside a SHA-256 checksum, that's what's expected.
  • Git's next-generation object format. Git 2.29+ supports SHA-256 as an alternative to SHA-1 for new repositories.
  • JWT signatures (HS256, RS256, ES256). The "256" in those algorithm names is SHA-256.

When to choose SHA-256 over SHA-512

  • Compatibility. Almost every system that accepts a hash accepts SHA-256. SHA-512 is well-supported but not universal.
  • Output size. SHA-256 fits in 32 bytes, SHA-512 in 64 bytes. For storage-sensitive applications (database columns, URL parameters, certificate fields), SHA-256 is half the size.

Choose SHA-512 when you're hashing many gigabytes of data on a 64-bit machine — SHA-512 operates on 64-bit words natively and can be marginally faster despite the larger digest.

When SHA-256 is not the right tool

  • Password storage. Same warning as the other fast hashes: use bcrypt, scrypt, or Argon2. SHA-256 is too fast — a modern GPU computes billions per second.
  • Message authentication. Use HMAC-SHA-256, not bare SHA-256. HMAC(key, message) is the construction; SHA-256 alone doesn't take a key.
  • Key derivation. Use HKDF or PBKDF2-SHA-256, not bare SHA-256. Direct hashing of a password into a key is unsafe.

Test vectors

Canonical SHA-256 test vectors from FIPS 180-4:

  • Empty string "" → e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • "abc" → ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
  • "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" → 248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1
  • "The quick brown fox jumps over the lazy dog" → d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592

Notes

Why 64 characters? SHA-256 produces 256 bits = 32 bytes = 64 hex characters.

Is this implementation constant-time? Yes — it uses the browser's WebCrypto crypto.subtle.digest, which the platform exposes as a constant-time native primitive. There is no early-exit on input data that would leak timing.

File size limits? The file picker hashes up to 256 MB locally. Larger files are technically possible but slow on the main thread; for those, prefer sha256sum in a terminal.

Why does my SHA-256 differ from sha256sum? Trailing newline. echo "hello" | sha256sum adds \n; pasting "hello" here does not. Use echo -n or the file picker for byte-exact matching.

  • Hash Generator — all five hashes side by side
  • SHA-512 — same security level, longer digest, faster on 64-bit CPUs
  • SHA-1 — predecessor, deprecated for security
  • Base64 — encode a binary digest for transport (e.g., SRI attributes)