SHA256 OnlineCheck a downloaded release
Compare an installer or archive with a SHA256 obtained from a trusted publisher. A matching checksum alone does not establish that the software is safe.
SHA-256 · Text & file checksums
SHA256 Online
Calculate a SHA256 hash from text or files. Compare a trusted checksum. Nothing is uploaded.
Input No upload
Output Your result · SHA256
SHA256 calculated
3 decoded bytes · UTF-8 · input changes update automatically
Browser-local hashing. Inputs masked in Clarity.
No account. No uploads. Just your browser.
THREE SIMPLE STEPS
From input to a clear comparison
A calculated digest and a verified match are different results. Here’s how to get both.
- 1
Choose your exact input
Replace the abc example with your text, or switch to Files & manifests. Select the encoding that represents your bytes.
- 2
Get the complete SHA256
The digest updates locally. Spaces, line breaks and file contents all count; filenames are not part of the hash.
- 3
Compare a trusted value
Paste the publisher’s expected SHA256. Read Match or Mismatch, then copy the digest or download a local report.
MADE FOR EVERYDAY CHECKS
Small checks. Useful answers.
Use a checksum to answer a specific question about your data.
Reproduce a text hash
Choose UTF-8 for literal text, or decode Hex or Base64 first. The abc example helps identify encoding or newline differences.
Verify a batch of files
Use a GNU or BSD checksum list to check exact filenames. Missing files and selected files absent from the list are reported separately.
BEFORE YOU COMPARE
Hashing is not encryption
Pick the operation that matches the question, not just the length of the output.
| Operation | What it does | What you need |
|---|---|---|
| SHA256 hash | Makes a 64-character hexadecimal fingerprint of exact bytes. | Text or a file. A trusted expected digest is needed for verification. |
| HMAC-SHA256 | Makes a keyed hash for checking messages with a shared secret. | The same message bytes, key bytes and algorithm on both sides. |
| Encryption | Protects readable content so it can be decrypted with a key. | A separate encryption tool; this page does not encrypt or decrypt. |
KNOW WHAT YOU ARE CHECKING
Exact bytes make the difference
The practical details behind the result, without hidden instructions or collapsed explanations.
SHA256 online, with a clear comparison
SHA256 is part of SHA-2 and produces a 256-bit result: 64 hexadecimal characters. It is a common choice for verifying downloads against a trusted publisher’s checksum. Hashing is one-way, not encryption.
Enter text and the complete digest updates automatically. Paste a trusted expected value to see Match or Mismatch. Without one, SHA256 calculated confirms the calculation—not verification of a source.
Text bytes matter
UTF-8 hashes the exact text, including newlines and spaces. Hex and Base64 decode into bytes before hashing; they do not hash the visible encoding characters. Try abc, 616263 in Hex, or YWJj in Base64 for the same result.
Open HMAC options to calculate a keyed hash. The key has its own UTF-8, Hex or Base64 setting, stays in memory, and is never put into a URL or browser storage.
Files, batches and checksum lists
Switch to Files & manifests to hash up to 100 selected files sequentially in a worker, with 2 MiB chunks and a 2 GiB per-file limit. Paste a GNU or BSD checksum manifest, or choose its local .sha256 file.
Exact filename matching avoids silently verifying the wrong file. Duplicate names and malformed lines block the list. Missing files and selected files not listed in the manifest are reported separately.
Private by construction
Hashing runs locally in your browser. Microsoft Clarity runs on all pages to help us understand page use; the entire tool workspace, including inputs, keys, filenames and results, is masked. Google Analytics runs only on About, Contact, Privacy and Terms. Google AdSense loads on every page to support advertising. See Privacy for connection metadata, cookies and identifiers.
A digest match is not proof that a file is safe or the publisher is genuine. Use a trusted expected checksum. MD5, SHA1 and CRC32 are provided for legacy checks, not new security designs.
Known result: empty input
SHA256 · 0 bytes · no HMAC. Empty input is not the same as no file selected.
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855QUESTIONS, ANSWERED
SHA256 online FAQ
Encoding, comparison and privacy—the details that change what your result means.
Why is abc already in the input?
It is a reproducible example: three UTF-8 bytes, with no trailing newline. Replace it with your own text or use Clear to hash empty input. The separate SHA256 hash generator starts blank.
Why does my SHA256 differ from a command-line result?
Compare the exact bytes first. A trailing newline, an extra space, different line endings or a different text encoding changes the digest. This tool does not trim your text. UTF-8 abc, Hex 616263 and Base64 YWJj decode to the same three bytes.
Is SHA256 encryption? Can I reverse the hash?
No. SHA256 is a one-way hash, not reversible encryption. This tool produces a fingerprint; it does not decrypt hashes, recover text or crack passwords.
Does Match prove that my file is safe?
No. Match means the calculated digest equals the value you supplied for that algorithm. Obtain the expected value from a trusted publisher. A checksum does not by itself authenticate that publisher or scan the file for malware.
What does SHA256 calculated mean?
The digest has been calculated from your input. No comparison is claimed until you paste a trusted expected value. Then the page reports Match, Mismatch or a format error.
Do uppercase and lowercase checksum letters compare equally?
Yes. Expected hexadecimal values are compared without letter case, and surrounding whitespace is ignored. The displayed digest uses lowercase. The expected SHA256 must still contain exactly 64 valid hexadecimal characters.
Are files, text or HMAC keys uploaded?
No. Calculation uses a local worker in your browser, with no file-upload endpoint. Clarity runs on all pages, but the tool workspace is masked, including text, keys, filenames and digests. See Privacy for analytics metadata and identifiers.
What are the file and text limits?
Up to 100 files per batch, 2 GiB per file, 1 MiB per checksum manifest and 8 MiB of decoded text. Files are read sequentially in 2 MiB chunks. Your device may have lower practical limits; desktop viewport tests do not establish physical-phone limits.
Can I verify a .sha256 checksum list?
Yes. Switch to Files & manifests, open the checksum-manifest options, then paste a GNU or BSD list or read its local file. Select files with the exact listed filenames. Duplicate names or malformed lines block verification; missing and unlisted files are reported separately.
What is the difference between SHA256 and HMAC-SHA256?
SHA256 hashes the input bytes alone. HMAC-SHA256 also uses a secret key, so both the message and key must match the other implementation. Open HMAC options for text, and choose the key encoding independently from the input encoding. Keys are not saved or put into URLs.
Does renaming a file change its SHA256?
Renaming without changing the file contents does not change its digest. Manifest verification still matches exact filenames, so a renamed file can be reported as missing even when its bytes are unchanged.
Can I use the page without JavaScript?
You can read the explanations and known empty-input checksum in the static HTML. Calculating your own text or files requires JavaScript and WebAssembly. No sign-in, payment or account is required.
Your bytes. Your browser.
Try the example, replace the input, and compare a checksum you trust.
By SHA256 Online · Last updated