Is SHA-256 the same as HMAC-SHA256?

No. A plain SHA-256 hash has no secret key. HMAC is a distinct keyed construction; use the HMAC tool when that is what the protocol specifies.

Can I paste a Base64 SHA-256 value into Compare?

No. This field expects 64 hexadecimal characters. Base64 is a different encoding of digest bytes; do not remove padding or change letters to make it look like hex.

Does typing 61 hash the byte 0x61?

No. The text editor hashes the characters 6 and 1 as UTF-8. To hash the byte 0x61 as text, enter a; for arbitrary binary bytes use a local file.

Is a webhook's SHA-256 signature always a plain hash?

No. Many protocols specify HMAC-SHA256 or another construction. Follow the provider's exact algorithm, key encoding and message-byte rules.

SHA-256 Hash Generator

What this tool calculates

SHA-256 is a SHA-2 algorithm with a 256-bit result. Its full hexadecimal representation is 64 characters. This is commonly used in download manifests, build pipelines and content identifiers. Copy the entire value: shortening it changes the comparison procedure and can materially weaken an identifier.

A plain SHA-256 digest has no secret key. Anyone who can change both an artifact and its accompanying checksum can produce another matching pair. Obtain the expected value from an authenticated publisher, and use a signature or a suitable keyed mechanism when authenticity is the actual requirement.

For text, the tool hashes UTF-8 bytes exactly as entered. For files, it streams the original bytes. Hashing the visible text of a PDF or the displayed contents of a ZIP is not the same as hashing that file. The comparison control validates 64 hexadecimal digits and distinguishes a malformed expected value from a well-formed mismatch.

Worked example

UTF-8 · abc · SHA-256

ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

How to calculate and compare

Enter the exact text in Input text, or choose Example to load abc. Text is encoded as UTF-8; spaces and line endings are preserved.
In single-text mode, non-empty input up to 64 KiB updates after a short pause. Click Generate hash for empty input or larger text. Changing the input clears the previous result.
To check a saved file instead, open File checksum, confirm the algorithm, and choose or drop the file. File mode reads its original bytes and starts automatically.

For line-by-line results, enable One hash per line, choose whether to include empty lines, then click Generate hash. Line mode does not calculate automatically. CRLF, LF and CR separate records and are not included in each line's digest. Duplicate lines retain their original line numbers.

Paste only the complete hexadecimal reference into Compare expected value (optional) and click Check. Letter case and surrounding pasted whitespace are ignored; internal spaces and the wrong length are rejected. Copy retains the full result. TXT and CSV exports include identifiers, algorithm names and digests, not source text or secret keys.

Limits, privacy and next steps

Text is limited to 10 MiB and line mode to 10,000 records, including empty records before filtering. Files are limited to 50 queue entries and 1 GiB each, read sequentially in 2 MiB chunks. These limits protect browser resources; they do not guarantee fast processing on every phone. Cancel if needed. Calculation takes place in the browser, while normal page and asset requests still reach the hosting service.

Verifying a release with SHA-256

Use the release's SHA-256 reference, not a value copied from a different build or platform. In File checksum mode, select SHA-256 and choose the downloaded artifact. Paste the full 64-character reference and compare it before installing or unpacking the file. A mismatch is a reason to investigate the release and download source, not to trim the computed result until it matches.

For debugging text integrations, distinguish a message from a textual representation of bytes. Entering the two characters 61 hashes UTF-8 bytes for those characters; it does not decode them into the single byte for a. This text editor accepts UTF-8 text, not raw Hex input. For request authentication that specifies a key, use HMAC rather than a plain SHA-256 digest.

The text 61 is not the byte 0x61

In single-text mode, calculate 61, then replace it with a. The different outputs below demonstrate why decoding and text encoding must not be confused.

SHA-256 / UTF-8 "61" (36 31):
d029fa3a95e174a19934857f535eb9427d967218a36ea014b70ad704bc6c8d1c
SHA-256 / UTF-8 "a" (61):
ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

When a SHA-256 check disagrees

Observed problem	Why it happens	What to do
The reference has 44 characters and ends in =	It may be Base64 rather than hexadecimal	Obtain or correctly convert the reference to 64 hex characters.
A sha256sum line is rejected	It includes a filename or marker	Paste the digest only; retain the filename separately.
A webhook signature differs	The protocol may require HMAC and exact request bytes	Use the HMAC tool with the specified key encoding and original message.

FIPS 180-4