Input
Settings
HMAC uses a secret key to create authenticated hash signatures
Hash Result
About This Tool
Generate SHA hash for text and files.
How to Use
Enter text or upload a file in the input panel. The tool instantly generates a 64-character hexadecimal SHA-256 hash. For text: useful when creating API request signatures, generating deterministic IDs from content, or hashing configuration data. For files: verify downloads by comparing generated hash with official checksums, detect file modifications, or create content-addressed storage keys. The hash is deterministic (same input = same output) and one-way (cannot reverse the hash to get original data). Performance: handles files up to ~100MB in browser; for larger files use command-line tools like shasum -a 256 (Mac/Linux) or certutil -hashfile [file] SHA256 (Windows).
Common Use Cases
Download Verification
Download software, generate SHA-256 hash, compare with vendor-published hash to ensure authenticity and detect tampering.
API Request Signing
Create HMAC-SHA256 signatures for AWS, Stripe, or webhook authentication: hash(secret + request_body) proves request authenticity.
Git Commit Hashes
Git uses SHA-256 (transitioning from SHA-1) to identify commits—understanding hashing helps debug merge conflicts.
Password Storage (with salt)
Hash passwords with unique salt before storage: `SHA256(password + random_salt)` then store both hash and salt (but use bcrypt in production).
Blockchain/Cryptocurrency
Bitcoin addresses and block hashes use SHA-256—useful for understanding crypto fundamentals.
Content Deduplication
Hash file content to detect duplicates in storage systems without comparing entire files.
Limitations & Important Notes
While SHA-256 is cryptographically secure for integrity and signatures, **DO NOT use raw SHA-256 for password hashing** in production. It's too fast—attackers can compute billions of hashes per second with GPUs. Use purpose-built password hashing functions like bcrypt, argon2, or PBKDF2 which include salting and key stretching. For API signatures, always use HMAC-SHA256 (hash with secret key) not plain SHA-256. Browser performance: large files (>100MB) may cause slowdowns or memory issues—use command-line tools for batch processing. SHA-256 is deterministic and one-way: (1) same input always produces same output (good for caching, bad for password storage without salt), (2) cannot reverse hash to retrieve original data. For compliance: some regulations (e.g., FIPS 140-2) require specific hash implementations—verify your crypto library is certified if needed.