How this calculator works
- Step 1Read the bytesUTF-8 or fileText becomes bytes; a file is read as it is.
- Step 2Mix them thoroughlySHA-256Every bit of input affects every bit of output.
- Step 3Get a fixed-size digest64 hex digitsThe same input always gives the same digest.
A hash is a fingerprint of data. It is easy to compute and practically impossible to reverse or to forge for a different input.
Worked example: two NIST messages
Any input, short or long, gives a digest of the same length that looks unrelated to it.
- Algorithm
SHA-256 (FIPS 180-4)
- “abc” (3 bytes)ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
- “abcdbcdecdef…” (56 bytes)248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1
- Digits in the same position2 of 64
- Digest length64 hex digits = 256 bits
Both values are the ones NIST publishes, and this page’s engine reproduces them.
Reading the result
- SHA-256 and longerUse theseCurrent standard for checksums and integrity checks.
- SHA-1Legacy onlyCollisions have been demonstrated; keep it for old systems only.
- Verify downloadsCompare with the checksum the publisher lists.
- Detect changesA different hash means the data changed.
- Not for passwordsStore passwords with Argon2id or scrypt instead.
- No MD5Browsers do not offer MD5; it is broken anyway.
Related developer tools
A hash fingerprints data; it cannot be reversed. Encoding can be.
To encode data reversibly, use the Base64 encoder and decoder. For a random secret, try the password generator, and for unique IDs, the UUID generator.
Common mistakes
Mistake: Copying text with a trailing line break.
Instead: Check the byte count; invisible characters change the hash.
Mistake: Taking the checksum from the same place as the file.
Instead: Get it from the official site over HTTPS.
Mistake: Hashing passwords with plain SHA-256.
Instead: Use a slow password-hashing function such as Argon2id.
Read how we test our calculators, or browse more developer tools.