SHA-256 Hash Generator (text)

Understanding the SHA-256 hash generator — concept and principle

SHA-256 turns any input into a fixed 256-bit fingerprint, written as 64 hexadecimal characters. This tool encodes your text as UTF-8 and hashes it entirely in your browser. SHA-256 is used to verify downloads, identify files and commits, sign certificates and documents, build blockchains and derive keys inside other constructions such as HMAC.

How it is calculated

The algorithm follows FIPS 180-4:

1. Encode: the text becomes a sequence of UTF-8 bytes.
2. Pad: append the byte 0x80, then zero bytes until the length is 8 bytes short of a multiple of 64, then the original length in bits as a 64-bit big-endian number.
3. Process blocks: each 64-byte (512-bit) block is expanded into 64 words of 32 bits, and 64 rounds of additions, rotations and bitwise functions (Ch, Maj, Σ0, Σ1) mix them into an eight-word state.
4. Output: the final eight 32-bit words, written in hex, form the 256-bit digest.

The starting state and round constants are derived from the fractional parts of the square roots and cube roots of the first prime numbers, so nobody could hide a trapdoor in them.

The principle

A cryptographic hash is designed to be one-way and collision resistant. Changing a single input bit changes about half of the output bits (the avalanche effect), so the digest looks random. Finding an input for a given digest is expected to take about 2^256 work, and finding any two inputs with the same digest about 2^128 by the birthday bound; no practical attack on SHA-256 is publicly known.

Worked example

1. Text: "hello", UTF-8 bytes 68 65 6c 6c 6f (5 bytes, 40 bits).
2. Padding: 5 bytes + 0x80 + 50 zero bytes + the length 0x28 in 8 bytes = exactly one 64-byte block.
3. After 64 rounds the digest is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
4. Typing "Hello" instead gives a completely different digest.

How to read the result

The digest always has 64 hex characters, whatever the input length. Two inputs match only if their hashes are identical; compare every character, not just the first few. Hidden differences such as a trailing space, a newline or a different Unicode form change the hash.

Common mistakes

• Expecting to "decrypt" a hash; hashing is not encryption.
• Hashing passwords with plain SHA-256; use a slow password hash such as Argon2id, bcrypt or PBKDF2 instead.
• Getting a different result from a command-line tool because echo added a newline.

Frequently asked questions

Is SHA-256 the same as SHA-2?

SHA-2 is the family (SHA-224, SHA-256, SHA-384, SHA-512 and others); SHA-256 is its 256-bit member.

Can two different texts have the same SHA-256?

In theory yes, since inputs are unlimited, but no collision has ever been found.

Is my text sent to a server?

No. The hash is computed locally in your browser.

Sources: NIST FIPS 180-4, Secure Hash Standard (SHS) · RFC 6234, US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)