SHA-256 hash generator: HEX and Base64 output, without sending data
Enter the text, pick an algorithm, and press Compute to get both HEX and Base64 at once. The digest is calculated locally by WebCrypto, so the content never leaves the browser. There is no MD5, because the browser does not provide one.
When a hash is the right tool
You are checking a SHA-256 checksum published on a release page or sent in an email. Hash the content and compare the result character by character to confirm the two sides match exactly.
The same content has to be delivered in two forms: one system stores HEX, another API accepts Base64. One computation gives you both columns, with no manual conversion.
You need a short fingerprint for a config snippet, a cache key, or a dedupe marker, or you want to confirm that two blocks of text are byte-for-byte identical.
- Check a SHA-256 checksum from a release page
- Deliver the same digest as HEX and Base64
- Create a cache key or dedupe fingerprint
- Confirm two text blocks are identical
How to get it right
First make sure the input is exactly right. A digest is byte-sensitive: a trailing newline, a missing space, or a full-width colon instead of an ASCII one changes the output completely. When checking file contents, watch for an editor that appends a final newline.
HEX and Base64 are two representations of the same bytes, not two different hashes. SHA-256 produces 256 bits, or 32 bytes: 64 HEX characters (lowercase here) or 44 Base64 characters including padding. Pick either for comparison, but use the same one on both sides and watch case and padding.
Choosing an algorithm: collisions in SHA-1 can be constructed in practice (SHAttered and later work), so it should not be used for signatures, certificates, or tamper detection; it is kept here for checking historical values. New designs should use SHA-256, with SHA-384 or SHA-512 when a longer digest is required.
There is no MD5 here because the browser does not provide one. WebCrypto's digest supports only SHA-1/256/384/512, MD5 never entered the standard, and the non-standard support some browsers once had was removed. For MD5, use the command line: md5sum, md5, or openssl dgst -md5.
A hash is not a password hash. A bare SHA-256 has no salt and is fast, so enumerable inputs such as passwords or phone numbers can be recovered with rainbow tables and GPU brute force. Password storage needs bcrypt, scrypt, or Argon2 — salted and deliberately slow.
One more thing worth remembering: a bare hash does not resist length-extension attacks, so anything involving a key should use HMAC rather than hash(key + message). This tool computes bare digests only; it offers no HMAC and no salting.
- One extra byte changes the digest completely
- HEX and Base64 are the same bytes in two notations
- SHA-1 is for checking historical values only
- No MD5, no HMAC, no salting
Alternatives and limits
For file checksums use the system tools: shasum -a 256 or sha256sum on macOS and Linux, certutil -hashfile on Windows. They read the file's bytes, unaffected by encoding or newlines, which is the correct way to verify an installer.
For HMAC, use WebCrypto importKey plus sign with the HMAC algorithm, or openssl dgst -sha256 -hmac on the command line. For password hashing, use a bcrypt, scrypt, or Argon2 library.
This tool digests UTF-8 text from the input box only. It cannot read a binary file and does not stream, supports only SHA-1/256/384/512, has no MD5, and does no HMAC or salting.
- File checksums → shasum or certutil
- HMAC → WebCrypto or openssl
- Passwords → bcrypt, scrypt, or Argon2
- Text digests only
FAQ
Can a hash be reversed?
No. A digest is one-way and fixed-length: the original information is gone, and the only approach is to guess candidates and compare. That said, irreversible is not the same as secure. Passwords, low-entropy passphrases, and phone numbers are enumerable, so rainbow tables, dictionaries, and GPU brute force can recover them quickly. Store passwords with a salted, deliberately slow algorithm such as bcrypt, scrypt, or Argon2; a plain SHA-256 is not a password hash.
Why is MD5 not offered?
Because the browser does not provide it. WebCrypto's digest supports only SHA-1, SHA-256, SHA-384, and SHA-512; MD5 never entered the standard, and the non-standard support some browsers once had was later removed. A JavaScript implementation would be slow and would need its own correctness guarantees, and MD5 collisions can already be constructed, so it should not be used for signatures or integrity checks. Use md5sum, md5, or openssl dgst -md5 locally when a legacy system requires it.
Is SHA-1 still usable?
It depends on the purpose. SHA-1 collisions can be constructed in practice (SHAttered and subsequent work), so signatures, certificates, and tamper detection should never use it. Legacy uses such as Git object IDs still run on it, but new designs should choose SHA-256. This tool keeps SHA-1 only for checking historical checksums, which is not an endorsement; like any bare hash, it also does not resist length-extension attacks, so keyed use needs HMAC.
Related tool：Hash Generator