Is SHA-256 encryption?

No. SHA-256 creates a fixed one-way digest without a key and cannot recover the original input. It is a hash function, not a cipher.

Can I hash an empty string?

Yes. Empty input is a valid byte sequence, and SHA-256 produces the well-known standard digest beginning with e3b0c44298fc1c14 for that case.

Why does my command-line result differ from the browser tool?

Check for an appended newline, text encoding differences, Unicode normalization, or a mismatch between file bytes and pasted text. Both sides must read the exact same byte sequence for the digests to match.

Is SHA-256 safe for storing passwords?

Not directly. SHA-256 is too fast for password hashing, which helps attackers test guesses. Use a purpose-built password hashing function with a unique salt and calibrated memory and time cost.

What happens if my file is larger than 100 MB?

The browser cryptography digest interface receives the full byte buffer rather than a stream, so files are capped at 100 MB. For larger artifacts, run a trusted streaming hashing tool on your local machine instead of exhausting browser memory.

Generate a SHA256 Hash Locally as Hex or Base64

A SHA-256 hash in JavaScript is the 256-bit digest produced by feeding exact bytes through the SHA-2 compression function defined in NIST FIPS 180-4, typically surfaced as 64 lowercase hexadecimal characters or as standard padded Base64. The browser's built-in Web Crypto API can compute it through crypto.subtle.digest('SHA-256', bytes), which is the same operation the SHA256 Hash Generator delegates to so you can produce the value without writing the boilerplate yourself. The generator runs entirely in your current browser tab, never uploads the content you select, and accepts UTF-8 text or up to 100 MB of file bytes. Because the same byte sequence always produces the same digest, you can copy either representation and compare it character-for-character against a reference value supplied by a vendor, build system, or signed release.

create sha256 hash in javascript — Generate a SHA256 Hash Locally as Hex or Base64

What SHA-256 Produces

SHA-256 belongs to the SHA-2 family specified by NIST FIPS 180-4. Internally, the algorithm pads a message, splits it into 512-bit blocks, expands each block into a 64-word schedule, and updates eight 32-bit working values. The final eight words form the 256-bit digest, and that output is deterministic: the same input bytes always produce the same 32 bytes, and there is no random salt, key, or initialization vector involved. Once the digest is computed, the tool renders it in two standard formats so you can hand it to whichever system you are integrating with. The lowercase hexadecimal form is 64 characters drawn from 0-9 and a-f, and the standard padded Base64 form is 44 characters drawn from A-Z, a-z, 0-9, +, /, and a trailing =. Both representations encode the same 32 bytes; changing letter case in the hex form changes the presentation, not the underlying digest.

Run the SHA256 Hash Generator in Your Browser

If you need the digest quickly without writing code, the SHA256 Hash Generator performs the full Web Crypto operation locally and returns both representations side by side. You paste a string or pick a file, the page encodes text as UTF-8 or reads file bytes directly, and the result is rendered as lowercase Hex and padded Base64 with the byte count shown for context. Because the calculation uses the platform cryptography implementation, the value matches what a correctly written JavaScript snippet would produce, what a command-line utility like sha256sum would produce for the same byte sequence, and what a vendor's published checksum should look like when the file was not tampered with. Eight NIST and RFC reference fixtures plus independently cross-checked text, punctuation, UTF-8, and binary cases back the implementation, and the tests assert the exact digest, its fixed 32-byte size, and the standard Base64 encoding.

Create a SHA256 Hash Step by Step

Open the SHA256 Hash Generator and choose whether you want to hash text or a file. Switch modes deliberately, because text mode encodes the string as UTF-8 bytes and file mode bypasses decoding to hash every selected byte.
Enter the exact content you want to verify. For text, paste the characters as they appear in the source you are comparing against; for files, pick the artifact up to 100 MB using the file selector. The displayed byte count is part of the result context, so note it.
Generate the SHA-256 digest. The page passes the bytes to the browser cryptography implementation, returns the 32-byte digest, and renders it as 64 lowercase hexadecimal characters and as standard padded Base64.
Copy the representation the other system expects. Use Hex if a vendor published a 64-character checksum, or use Base64 if the target field expects the 44-character padded form. Both encode the same bytes.
Compare the complete output rather than a prefix. A matching digest is meaningful only when the expected value itself is authentic, so obtain reference hashes over HTTPS from the owner, through a signed release, or through another authenticated channel appropriate to the risk.

The Web Crypto API Path in JavaScript

When you would rather call SHA-256 directly from JavaScript, the modern browser approach uses the asynchronous SubtleCrypto.digest interface. The input must be a BufferSource, which is why strings are encoded with TextEncoder first and files are read with FileReader or Blob.arrayBuffer. The returned ArrayBuffer is the raw 32-byte digest, and converting it to hex is a small loop over each byte. A minimal, complete example looks like this:

async function sha256Hex(text) { const bytes = new TextEncoder().encode(text); const digest = await crypto.subtle.digest('SHA-256', bytes); return [...new Uint8Array(digest)] .map(b => b.toString(16).padStart(2, '0')) .join(''); }

The same pattern works for a File object by replacing new TextEncoder().encode(text) with await file.arrayBuffer(). To get padded Base64 instead of hex, run the resulting Uint8Array through btoa(String.fromCharCode(...bytes)) and append = only if the byte length is not a multiple of three — for a 32-byte SHA-256 digest the padding is always one =. If you want a deeper walkthrough of edge cases and the relationship between Web Crypto and a ready-made tool, see the Generate a SHA-256 Hash in JavaScript: Web Crypto and Tool guide. The specification behind both routes is NIST FIPS 180-4, so a JavaScript implementation and the SHA256 Hash Generator cannot disagree when they hash the same bytes.

Why Your Hash Might Differ From Another Tool

The most common cause of a mismatched digest is a hidden byte difference, not an algorithm difference. Text mode encodes your string as UTF-8 before hashing, which matters because a character like é is two bytes and an emoji is typically four bytes. If the reference utility treated your input as Latin-1 or as code points, the byte sequence will diverge and the digests will too. Spaces, carriage returns, final newlines, and Unicode normalization forms are also bytes and can change the result, so a shell command that appends a trailing newline will produce a different hash than pasting the content without one. When comparing with a command-line utility, make sure both sides read the same file and that no extra newline slipped in. File mode avoids that problem by hashing every byte of the selected artifact including headers, embedded metadata, and line-ending bytes, so the SHA256 Hash Generator and a correctly invoked sha256sum on the same file will agree.

When SHA-256 Is the Wrong Tool

SHA-256 is one-way and keyless, which makes it excellent for integrity checks and inappropriate for several adjacent tasks. Use the digest for verifying downloads, identifying whether two artifacts are byte-for-byte identical, or generating a value required by a build and deployment workflow. Do not store passwords by applying SHA-256 directly: its speed helps integrity checks but also helps attackers test password guesses, so account systems should use a unique salt and a purpose-built password hashing function with calibrated memory and time cost such as Argon2id, scrypt, or bcrypt. SHA-256 also does not authenticate who created an input, so use HMAC-SHA-256 when two systems share a secret and need message authentication, or a digital signature when a verifier must establish origin using a public key. The table below summarizes when raw SHA-256 is the right primitive versus when to reach for an authenticated variant.

Use Case	SHA-256 Alone?	Better Alternative
Verify a downloaded file against a vendor checksum	Yes	—
Confirm two artifacts are byte-for-byte identical	Yes	—
Store user account passwords	No	Argon2id, scrypt, or bcrypt with a unique salt
Authenticate a message between two parties sharing a secret	No	HMAC-SHA-256
Prove that a specific key holder created a message	No	A digital signature such as Ed25519 or ECDSA

Record the algorithm name alongside any stored digest so a 64-character SHA-256 value cannot later be confused with another format or an undocumented checksum. The generator accepts empty text on purpose because the empty byte string has a legitimate standard digest beginning e3b0c442, and the asynchronous job identity prevents an older file read or hash from replacing a newer selection while the page is working.

If you're weighing options, Generate a SHA-512 Hash on Linux Without the Terminal covers this in detail.