How to generate a SHA-256 hash

A download page shows a 64-character string of gibberish next to the installer and politely asks you to verify it. Most people scroll past. Here’s what that string is, why it’s worth checking, and how to make one yourself in a few seconds.

What is a hash function

A cryptographic hash function takes input of any size and returns a fixed-size output, called the hash or digest. Think of it as a fingerprint for data.

It’s deterministic: the same input always gives the same hash. It’s one-way, so you can’t work back from the hash to the input. And changing even one character produces a completely different hash, which is known as the avalanche effect.

SHA-256("hello")  = 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-256("hello.") = 1589999b0ca6ef8814283026a9f166d51c70a910671c3d44049755f07f2eb910

One extra period, and not a single character of the hash survives. That sensitivity is why hashes underpin digital signatures, password storage, integrity checks and blockchains.

SHA algorithms compared

The Secure Hash Algorithm (SHA) family has several members with different output sizes and security.

SHA-1

SHA-1 was used everywhere for years but is now considered broken. In 2017 Google and CWI published a practical collision: two different PDF files with the same SHA-1 hash. Don’t use it for security. You’ll still see it in older systems and in Git, which identifies commits by SHA-1 by default.

SHA-1("hello") = aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d

SHA-256

SHA-256 belongs to the SHA-2 family and is the most widely used hash today, in TLS certificates, code signing, Bitcoin and most modern security software. No practical attack on it is known.

SHA-384 and SHA-512

These give longer outputs for a larger security margin. SHA-512 is often faster than SHA-256 on 64-bit processors, because it works on 64-bit words. SHA-384 is SHA-512 with different starting values and the output cut to 384 bits.

What hashes are used for

Checking file integrity

Software downloads often come with a SHA-256 checksum. Hash the file after downloading it and compare the result with the published value. If they match, the file wasn’t corrupted or changed on the way.

shasum -a 256 downloaded-file.zip
# or, on most Linux systems
sha256sum downloaded-file.zip

Get-FileHash downloaded-file.zip -Algorithm SHA256

Storing passwords

Passwords should never be stored in plain text. Store a hash instead, and when someone logs in, hash what they typed and compare. Use a purpose-built password hash such as Argon2, bcrypt or scrypt. These are deliberately slow and salted, which makes brute-force attacks expensive. Plain SHA-256 is far too fast for passwords: a single modern GPU can try billions of guesses a second. Keep it for checksums and signatures.

Spotting duplicates

Backup tools, cloud storage and version control hash file contents to find duplicates and detect changes without comparing whole files. If two files have the same SHA-256 hash, they are almost certainly identical.

Digital signatures

Signature schemes hash the document first and sign the hash with a private key. Signing a short, fixed-size hash is much faster than signing the whole document.

How to use the hash generator

1. Open the hash generator and type or paste your text.
2. The SHA-256, SHA-384, SHA-512 and SHA-1 hashes appear together and update as you type. The input shows its length in characters and in bytes.
3. Turn on Uppercase if you need the letters a to f in capitals, then select Copy next to the hash you want.

The text is encoded as UTF-8 and hashed in your browser with the Web Crypto API, so nothing is sent to a server. The tool hashes text, not files. For a file, use one of the commands above.

Hashing in code

Most languages have SHA-256 built in.

const buffer = await crypto.subtle.digest(
  "SHA-256",
  new TextEncoder().encode("hello"),
);
const hex = [...new Uint8Array(buffer)]
  .map((b) => b.toString(16).padStart(2, "0"))
  .join("");

import hashlib

hashlib.sha256(b"hello").hexdigest()

printf "hello" | shasum -a 256

Use printf or echo -n so the shell doesn’t add a trailing newline, which would change the hash.