Hash

Paste text and read its SHA-256 and SHA-512. The digest is computed in your browser, and nothing is sent to a server.

Paste text. Both digests show up here, in lowercase hex.

Learn more about SHA-256 and SHA-512

What is this tool?

SHA-256 and SHA-512 are cryptographic hash functions from FIPS 180-4, published by NIST in August 2015. SHA-256 writes 256 bits, which is 64 hex characters. SHA-512 writes 512 bits, which is 128 hex characters.

The page hashes the UTF-8 bytes of the text you paste, including spaces and a trailing line break. The same letters with a different encoding, or with a final newline, are a different digest.

Typical use cases

Checking a checksum that a doc published as hex.
Comparing two snippets when you only have their digests.
Seeing how one extra character changes both lengths of hash.

How to use it

Paste the text. An empty field clears the digests.
Read SHA-256 and SHA-512 in lowercase hex. Both are computed together.
Copy the line you need. The bytes are the UTF-8 encoding of the field, not a trimmed copy.

The text stays in your browser. Nothing is uploaded.

Before / after examples

The string abc

Before

abc

After

SHA-256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
SHA-512 ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f

A trailing newline changes the digest

Before

abc
abc plus a newline

After

SHA-256 of abc is not the SHA-256 of abc followed by a line feed.

Common mistakes

A password store

Invalid

SHA-256 of the password, stored as-is

Valid

A slow password hash with a salt

SHA-256 is fast on purpose. It is the right tool for a checksum or a content id. It is a poor password hash: there is no salt, and an attacker can test guesses very quickly.

A text longer than 100,000 characters shows an error and keeps the previous digests. Clearing the field clears them.

Good to know

The digests come from crypto.subtle.digest, the Web Cryptography API. The hex alphabet is 0-9 and a-f.

The share link stores the text, not the digests. Opening the link computes SHA-256 and SHA-512 again. Anyone who has the link can read that text.

Did you know?

SHA-256 of the empty string is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. This page clears the result when the field is empty, so that constant does not appear until you hash a text that really is those bytes.

Bitcoin’s block header is hashed with SHA-256 applied twice. That construction is often called SHA256d. A single SHA-256, which is what this page shows, is a different value.

Frequently asked questions

Does the text leave my browser?: No. Hashing runs on your machine. A share link puts the text in the URL fragment: that fragment is not sent with the HTTP request, but anyone who has the link can read it.
Where is SHA-1?: It is not on this page. A practical collision for SHA-1 was published in 2017 (SHAttered). SHA-256 and SHA-512 are the digests offered here.
Why does é not match a one-byte hash from another tool?: é is U+00E9. UTF-8 writes it as the two bytes C3 A9. A tool that hashes a single Latin-1 byte is hashing a different string.