SHA-256 Hash Generator

How to verify a file with SHA-256

1. Switch to File and choose the file you downloaded, or type text to hash.
2. The SHA-256 checksum appears at the top as 64 hexadecimal characters.
3. Paste the checksum from the download page into the compare box and look for the green match.

Why download pages list a SHA-256 value

Operating system images, open-source releases, firmware updates, password managers and crypto wallets usually publish a SHA-256 checksum next to each download, or in a file named something like SHA256SUMS. The idea is simple: if the file on your disk produces the same 64-character value, it is exactly the file the publisher released. A mismatch means something went wrong: the download was cut short, a mirror served a stale or damaged copy, or, rarely, someone swapped the file.

For the tampering case to be caught, the checksum has to come from a trustworthy place, ideally the project's official HTTPS site rather than the mirror the file came from. Some projects also sign their checksum files with a key, which protects even against a compromised website.

No command line needed

Every desktop system can calculate SHA-256 from a terminal:

That's fine if you're comfortable in a terminal, but it's easy to mistype a path, and comparing two 64-character strings by eye is error-prone. Here you choose the file, paste the expected value and get a clear match or no-match answer. Spaces and upper/lower case in the pasted value are ignored. It also works on a Chromebook or a phone, where there's no terminal handy.

The file is read and hashed on your own device using the browser's Web Crypto engine; nothing is uploaded, so checking a 3 GB installer doesn't mean sending 3 GB anywhere. On devices with limited memory, files well above 1 GB may be too large for the browser to hash in one go, and the page tells you if that happens.

Test values

To see that the calculation is right, hash these inputs in text mode:

• empty text → e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• abc → ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Text is encoded as UTF-8 before hashing. A line break at the end is part of the input, so "abc" followed by Enter gives a different value; that's also the usual reason a hash of text copied from a file doesn't match.

About SHA-256

SHA-256 belongs to the SHA-2 family standardized by NIST in FIPS 180-4. It produces a 256-bit digest, and no practical collision or preimage attack is known. It's used in TLS certificates, code signing, Git's newer object format, Bitcoin and countless integrity checks. Below the main result you'll also find MD5, SHA-1, SHA-384 and SHA-512 of the same input, in case a publisher uses one of those instead. Remember that a fast hash like SHA-256 is still the wrong choice for storing passwords; that job calls for Argon2, scrypt or bcrypt. To create a strong password in the first place, use the Password Generator.

More ways to use this tool