Input type

Hashes the exact text box value as UTF-8, without trimming or Unicode normalization. Empty text is valid.

Limits: 2 MiB UTF-8 text · 20 MiB file · Native Web Crypto over HTTPS

01 / Source

Text to hash

Maximum 2 MiB (2,097,152 UTF-8 bytes). Spaces and line breaks affect the checksum.

0 UTF-8 bytes

The example only loads into an empty text box. Clear your text before loading it.

Text, file contents, filenames, hashes and expected checksums are processed on your device. This tool does not upload them or save them to browser storage. The site uses Google Analytics for page visits; these values are not sent as analytics events. Only a fixed page URL is included in the page-view event.

02 / Checksum

SHA-256 hash (64 hexadecimal digits)

—

Expected SHA-256 (optional)

Paste exactly 64 ASCII hex digits (0–9, A–F). Comparison ignores letter case and surrounding whitespace. Edit this value to compare again without rehashing.

Optional: paste an expected checksum to compare with the generated hash.

Text mode hashes the UTF-8 encoding of the text box value. Browsers can normalize pasted CRLF/CR line endings to LF. File mode hashes every original byte, including any BOM and line endings, without decoding.

How to generate and compare SHA-256

Choose Text or File. Paste text, or select a local file within the displayed limit.
Select Generate SHA-256. Empty text and empty files have valid hashes.
Optionally paste a trusted expected checksum. A clear Match, Mismatch or Invalid message appears automatically.
Copy the hash. You can change the expected value without reading the file or calculating the hash again.

Does a matching checksum mean a file is safe?

No. A matching SHA-256 checksum does not prove safety or authenticity. It shows that your computed checksum equals the expected value. An attacker can replace both a file and the checksum beside it.

Get the expected value through a trusted, independent source when possible, and verify publisher signatures where available. This tool does not scan for malware, verify signatures or establish who supplied a file.

What is SHA-256?

SHA-256 is a cryptographic hash function that maps input bytes to a 256-bit value, commonly written as 64 hexadecimal digits. The same bytes produce the same value; a changed space, newline or byte normally changes the checksum.

Hashing is not encryption and has no decrypt operation. A plain SHA-256 hash is not a suitable password-storage scheme or a keyed authentication code such as HMAC.

Why can text and file hashes differ?

Text mode encodes the exact text box value as UTF-8. No spaces are trimmed, no Unicode normalization is applied, and no extra BOM is added. An existing U+FEFF character is retained. Unpaired UTF-16 surrogates are rejected rather than replaced.

File mode reads raw bytes. A file saved in UTF-16, a UTF-8 file with a BOM, or a file with CRLF instead of LF line endings can hash differently from visually identical pasted text. Browser text boxes can normalize line endings; use file mode when original bytes matter.

A known example: abc, with no newline

The three UTF-8 bytes of abc produce:

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Adding a trailing newline produces a different hash. Empty text or a zero-byte file produces:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

What can I paste as the expected checksum?

Use one 64-digit SHA-256 value with ASCII characters 0–9, a–f or A–F. Uppercase and lowercase compare equally, and surrounding whitespace is removed only from the expected value.

Do not include SHA256:, a filename, internal spaces or a checksum list. An invalid expected value does not stop hashing or discard your selected file. Clearing the expected field leaves the generated hash available.

Why are there size limits?

Text is limited to 2 MiB of UTF-8 bytes; a file is limited to 20 MiB. File size is checked before reading. The native SubtleCrypto.digest() API is not streaming: the entire file and temporary byte copies are held in memory, so peak memory use can exceed the file size.

For larger files, use a local command-line utility such as sha256sum, shasum -a 256 or PowerShell Get-FileHash -Algorithm SHA256. This page never uploads files for server-side processing.

Which browsers are supported?

This tool requires native Web Crypto SHA-256 in a secure context, normally HTTPS. Text mode also requires native TextEncoder. If those APIs are unavailable, it shows an explanation instead of using a substitute algorithm.

Editing the source, choosing another file, changing mode or clearing the tool invalidates the old result. Text and file selections remain separate while you switch modes. Clear all removes both drafts and the expected value; the tool does not persist them.