Hash text or files with SHA-256 instantly. Type below for a live digest, or drop a file to checksum it against a published hash - all hashing stays in your browser.
Technical Specifications
Algorithm and input rules used for every digest.
| Specification |
Details |
| Algorithm |
SHA-256, NIST FIPS 180-4: 256-bit digest, 64 rounds, 64 hex characters |
| Engine |
Web Crypto API (crypto.subtle.digest) - native code, no libraries |
| Text encoding |
UTF-8 bytes via TextEncoder, so emoji and non-Latin text hash correctly |
| File input |
Any file up to 100 MB via drag-drop or picker; bytes hashed exactly as stored |
| Active source |
One source at a time: typing selects text, dropping or picking selects the file |
| Output encoding |
Hexadecimal, lowercase by default with an uppercase toggle |
| Verification |
Expected hash compares case-insensitively with whitespace ignored; shows match, mismatch, or invalid-length states |
| Processing location |
100% client-side JavaScript in your browser memory; nothing is uploaded |
| Export |
Copy the digest to clipboard or download a plain-text report with source and verification result |
| Usage limit |
None - hash unlimited texts and files for free, no signup required |
Understanding SHA-256
SHA-256 maps any input - a word or a gigabyte video - to a fixed 256-bit fingerprint written as 64 hex characters. The same bytes always yield the same digest, while flipping a single bit avalanches into an unrelated one. After two decades of analysis it remains unbroken, which is why it anchors certificates, blockchains, and software distribution.
Verifying downloads the right way
Publishers post SHA-256 checksums beside installers and disk images precisely so you can confirm the bits you received. The workflow is always the same: hash the local file, compare strings character by character. A match proves byte-identical content; any mismatch - even from a single flipped bit in transit - means stop and re-download from a trusted mirror.
Text hashing and password storage
Developers hash API payloads and messages to detect tampering, and systems store salted password hashes instead of passwords - slowing guesses with thousands of iterations. Never store a bare SHA-256 of a password: GPUs try billions per second, so short secrets need dedicated functions like bcrypt or Argon2. To audit a password's guessability instead, use the Password Strength Checker.
SHA-256 versus MD5 and SHA-1
MD5 and SHA-1 both suffer practical collision attacks, so they survive only for legacy checksums - compare them with the MD5 Generator or the SHA Hash Generator when old systems demand them. For anything new, SHA-256 is the conservative default; SHA-384 and SHA-512 serve policies requiring larger digests.
Honest limitations
Files above 100 MB are refused to protect the tab's memory - split archives or use a desktop checksum tool for those. A matching digest proves the bytes equal the published original, but says nothing about whether the publisher itself is trustworthy; always fetch checksums over HTTPS from the official source. And like all hashes, SHA-256 cannot be reversed.
Privacy and Client-Side Security
Privacy Guarantee: All hashing occurs locally inside your browser. Your text, file bytes, and digests are never transmitted, stored, or recorded on remote servers.
File checksums are the case where privacy matters most: uploading a sensitive document just to hash it would defeat the purpose. TinyToolzz reads files with the FileReader API into tab memory and digests them with native SubtleCrypto - the bytes never touch a network.
Because nothing is uploaded, there is no waiting, no account, and no copy of your data retained anywhere. Your values exist only in the tab's memory and are discarded when you close the page or click Clear.