What SHA-256 Is
SHA-256 is a cryptographic hash function from the SHA-2 family. It takes any input and produces a fixed 256-bit fingerprint — written as 64 hex characters like 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Unlike MD5 and SHA-1 (both broken for security uses), SHA-256 is still considered cryptographically secure as of today and is the workhorse hash for modern systems.
The Microapp generator computes the SHA-256 of any text you paste, in your browser, using the native crypto.subtle API that ships in every modern browser. Your text never leaves your device.
How to Use It
- Paste or type text into the input box.
- The SHA-256 hash appears instantly — 64 lowercase hex characters.
- Click "Copy" to put the hash on your clipboard.
- To verify a downloaded file matches a published hash, hash a small piece of text first to confirm the tool works as expected, then use a CLI tool like
sha256sumfor the actual file.
hello:2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824Capitalize the H —
Hello — and the hash is completely different:185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969Single-bit changes produce uncorrelated outputs. This is what makes SHA-256 useful for detecting any tampering.
What SHA-256 Is Used For
Digital signatures. When you sign a document or a software release, you actually sign the SHA-256 of the document, not the document itself. Signing a hash is fast and produces a fixed-size signature regardless of input size.
Bitcoin and blockchains. Bitcoin's proof-of-work is SHA-256 applied twice to a block header. Miners compete to find an input that hashes to a value below a target — there's no shortcut, you have to try guesses. Most cryptocurrencies use either SHA-256 or a related hash (SHA-3, Blake2, etc.) at their core.
SSL/TLS certificates. Modern HTTPS certificates use SHA-256 in their signature. When you visit a website over HTTPS, your browser verifies the certificate's SHA-256 signature against the issuing authority's public key.
Software integrity (the modern replacement for MD5). Linux distributions, open-source projects, and software vendors publish SHA-256 alongside downloads so you can verify your file matches what was released. Compute the SHA-256 of your downloaded file; compare to the published value; if they match, the file is unaltered.
Git commit hashes. Git identifies every commit by a SHA-1 today (transitioning to SHA-256 in newer versions). The hash captures the commit's content, parents, author, message — change any of those and the hash changes, which is how Git detects tampering with history.
What SHA-256 Is NOT For
Password hashing. Even though SHA-256 is cryptographically secure, it's fast — billions of hashes per second on a modern GPU. Storing a password as a SHA-256 hash means an attacker with your database can brute-force most passwords in hours. Use bcrypt, Argon2, or scrypt for passwords. Those are deliberately slow.
Encryption. Hashing is one-way. There's no SHA-256 "decryption" — you can't recover the input from the hash. If you need to protect data so it can be retrieved later by an authorized party, use AES, RSA, or another encryption algorithm.
SHA-256 vs MD5 vs SHA-1
| Hash | Output | Status | Use for… |
|---|---|---|---|
| MD5 | 128 bit / 32 hex | Broken (collisions found 2004) | Non-security: dedup, cache keys, integrity of accidental corruption |
| SHA-1 | 160 bit / 40 hex | Broken (collisions found 2017) | Legacy only — Git, older protocols. Don't choose for new work. |
| SHA-256 | 256 bit / 64 hex | Secure, widely used | Anything security-sensitive: signatures, certificates, blockchain, file verification |
| SHA-3 (Keccak) | Variable | Secure, alternative design | Same use cases as SHA-256, hedge if SHA-2 family is ever broken |
Common Questions
"Is SHA-256 quantum-resistant?" Mostly yes for collision resistance — Grover's algorithm reduces the security level, but a 256-bit hash still has 128-bit security against quantum search, which is fine. The signature scheme using SHA-256 (RSA, ECDSA) is what's broken by quantum computers, not SHA-256 itself.
"How big can the input be?" SHA-256 accepts inputs up to 2^64 bits — about 2 exabytes. Practically: any file, any document, any message you'll ever encounter.
"Why 64 hex characters?" 256 bits ÷ 4 bits-per-hex-character = 64 hex characters. SHA-512 produces 128 hex chars; SHA-1 produces 40; MD5 produces 32.
Related Tools
For non-security fingerprinting, the older MD5 Hash Generator is faster and still fine for dedup or accidental-corruption checks. To represent binary data as text (instead of hash it), use the Base64 Encoder/Decoder. For password generation that should be hashed with bcrypt-not-SHA, see the Password Generator.