What Is a SHA-256 Hash and How Do You Generate One?
Updated October 22, 2026
A hash turns any amount of data into a short, fixed-size fingerprint. SHA-256 is the most widely used one today. Here is how it works and when to use it.
What a hash does
- The same input always gives the same hash. The text "hello" always gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 in SHA-256.
- A tiny change gives a completely different hash. "Hello" with a capital H gives 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969.
- The hash is always the same length, 64 hexadecimal characters for SHA-256, however big the input is.
- You cannot work backwards from the hash to the original data. That is why it is called one-way.
What SHA-256 is used for
- Checking a download: the publisher shows the file's hash, you hash your copy, and if they match the file is intact.
- Digital signatures and security certificates.
- Blockchain systems such as Bitcoin.
- Detecting changes in data, for example to see if two files are identical.
SHA-256 compared with other hashes
| Hash | Length (hex characters) | Status |
|---|---|---|
| MD5 | 32 | Broken for security. Fine for quick checks against accidents. |
| SHA-1 | 40 | Broken for security. Being phased out. |
| SHA-256 | 64 | Secure and the usual choice. |
| SHA-512 | 128 | Secure, with a longer fingerprint. |
Do not hash passwords with plain SHA-256
SHA-256 is designed to be fast, which is the opposite of what you want for storing passwords: an attacker can try billions of guesses a second. For passwords, use a slow, salted algorithm made for the job, such as Argon2, bcrypt or scrypt.
How to generate a SHA-256 hash
| Where | Command |
|---|---|
| This site | Paste text or choose a file in the SHA-256 Hash Generator. Nothing is uploaded. |
| Windows PowerShell | Get-FileHash file.zip -Algorithm SHA256 |
| macOS and Linux | shasum -a 256 file.zip |
| Linux | sha256sum file.zip |
| JavaScript | await crypto.subtle.digest("SHA-256", data) |
Frequently asked questions
Can a SHA-256 hash be decrypted?
No. A hash is not encryption, so there is nothing to decrypt. Websites that claim to reverse hashes only look the hash up in a list of known inputs, which works for common words but not for random data.
Is SHA-256 the same as SHA-2?
SHA-2 is a family of hash functions that includes SHA-224, SHA-256, SHA-384 and SHA-512. SHA-256 is the most popular member.