Hashes and checksums in your browser
SHA-256 turns any input into a fixed 64-character fingerprint. Change a single character and the hash changes completely, which makes it ideal for verifying downloads, detecting changed files, deduplicating data and signing API requests. Type text (encoded as UTF-8) or choose a file up to 512 MB, and see its SHA-256 alongside SHA-1, SHA-384, SHA-512 and MD5.
Turn on HMAC and enter a secret key to create keyed signatures, the kind webhooks from Stripe, GitHub and Shopify use. Choose hex, uppercase HEX or Base64 output, and paste a published checksum into the compare box to confirm a match instantly.
How to generate a SHA-256 hash
- 1
Enter text or choose a file
Files are read locally, never uploaded.
- 2
Add an HMAC key if needed
For signed webhooks and APIs.
- 3
Pick the output format
hex, HEX or Base64.
- 4
Copy or compare
Paste a checksum to verify it.
Key features
Five algorithms
SHA-256, SHA-1, SHA-384, SHA-512 and MD5.
File checksums
Hash files up to 512 MB in the browser.
HMAC signatures
Keyed hashes for webhook verification.
Checksum compare
Matches hex or Base64 in any letter case.
Common uses
- Verifying downloads: Confirm an installer or ISO matches the publisher's checksum.
- Webhook debugging: Recreate an HMAC-SHA256 signature to compare with a header.
- Data integrity: Detect whether files or records have changed.
Tips and good to know
- Hashing is not encryption: you can't turn a hash back into the input.
- Don't use plain SHA-256 for passwords. Use the bcrypt Password Hash Generator instead.