Generate and verify hashes under the same input conditions
Generate Digests using five methods in the Browser from a string or local file, then compare them with known HEX or Base64 values.
Generate a SHA-256 hashConclusion: Fix the algorithm and UTF-8 byte sequence, then verify the generated 64-character HEX value
Text is converted to a UTF-8 byte sequence with TextEncoder, and that byte sequence is passed to SHA-256. The Digest is 32 bytes; in HEX display, each byte is represented by two characters, for a total of 64 characters.
Even if they look the same, different encoding, line breaks, spaces, or Unicode code point sequences produce different hashes. This is not called encryption with SHA-256.
The current Tool generates all 5 methods at once. Check the SHA-256 row in the result table and the selected HEX/Base64 format.
Check the three stages: String, byte sequence, and Digest
What a hash function directly receives is not the meaning of characters but a byte sequence. Match the encoding used by the environment that stores or sends the input.
Current Text Mode is fixed to UTF-8 and does not add a BOM or normalize Unicode. It also cannot specify Shift_JIS.
| Item | How to check | judgment |
|---|---|---|
| Algorithm | SHA-256 row in the results table | Do not confuse it with other methods |
| Encoding | Text Mode uses UTF-8 | Matches the comparison source |
| Input | Check including line breaks and spaces | Do not trim automatically |
| output | 64 HEX characters or Base64 | Compare using the same representation. |
How to check using the hash generation and verification tool
- Select the text and paste it without changing the original.
- Set the display format to HEX and select lowercase or uppercase if needed.
- Generate a hash value and check the SHA-256 line.
- If necessary, enter the value to compare and check the match display.
An empty string cannot be generated in Text Mode. You can check the SHA-256 of empty data as a 0-byte file in File Mode.
Do not confuse SHA-256 input and output.
String "hello"
-> UTF-8 bytes 68 65 6c 6c 6f
-> SHA-256 digest (32 bytes)
-> HEX / Base64 textHEX and Base64 can represent the same digest byte sequence as different strings. Comparing HEX and Base64 as strings does not produce a match.
Consider hashing, encryption, encoding, and authentication separately
| processing | Input | Output and purpose | Action to return to the original |
|---|---|---|---|
| Hash | Byte sequences of arbitrary length | Fixed-length digest and integrity verification | Not intended for decryption |
| Encryption | Plaintext and Key | Ciphertext and confidentiality | Decrypt with the correct key |
| Base64 | Byte column | Represent as ASCII text. | Return to the original byte sequence by decoding |
| HMAC | Secret Key and Message | Authentication codes, integrity, and authenticity | Recalculate and verify using the same key. |
| Password Hash | Password, Salt, and Cost | Make guessing attacks costly and verify | Use a dedicated scheme such as Argon2id. |
Do not describe a hash as “encrypted with SHA-256.” The same input byte sequence and algorithm produce the same digest, but this does not mean different inputs can never produce the same value anywhere in the world. Also verify separately whether the source distributing the expected value is trustworthy.
Treat MD5 and SHA-1 as compatibility checks for legacy systems or existing checksums; do not recommend them for new uses requiring tamper resistance. Do not use fast general-purpose SHA-256 alone for password storage; select a purpose-appropriate scheme and settings such as Argon2id, scrypt, bcrypt, or PBKDF2.
Supported scope of the current hash generation and verification tool
| Item | Current specification |
|---|---|
| Input | UTF-8 text or multiple local files |
| Algorithm | Generate SHA-512, SHA-384, SHA-256, SHA-1, and MD5 at once |
| output | HEX or Base64. HEX can be switched between lowercase and uppercase |
| Verification | Compare expected values with all results. HEX is case-insensitive; Base64 is case-sensitive |
| Processing method | Read the entire file into an ArrayBuffer with FileReader and calculate in a Web Worker |
| Actions | Individual copy, copy all, clear all, cancel processing, and process multiple files |
| Unsupported | SHA-224, SHA-3, HMAC, Encoding selection, BOM removal, line-break conversion, Unicode normalization, Streaming, and Download |
| Empty data | Empty input in the Text field is an Error. A 0-byte File can be calculated in File Mode |
Text Mode converts to a UTF-8 byte sequence using TextEncoder. It does not trim input Text, normalize line endings, remove BOMs, or perform Unicode Normalization. However, only the comparison field removes leading, trailing, and embedded whitespace from the pasted Digest before comparison.
SHA-1, SHA-256, SHA-384, and SHA-512 are calculated with the Web Crypto API; MD5 is calculated with an implementation in a Worker. The Hash target is the loaded Byte sequence, not the file name or modification time.
Browser processing and large-file limitations
The current tool does not send input text, file contents, generated digests, or expected digests to the DevelopTools server or external APIs, and does not save them to LocalStorage or SessionStorage. It also does not send input values to analytics.
- Process confidential files on a trusted device and browser
- After copying, consider that it may remain in OS or browser clipboard history
- Because the entire file is loaded into memory, check available memory and browser limits
- For very large files, also consider OS commands and similar tools that support streaming.
- Obtain verification values through trusted channels such as official sites or signed channels
Because SubtleCrypto.digest() does not accept Streaming Input, the current implementation also reads the entire File into Memory. Browser-based processing avoids Uploads, but it does not guarantee protection from Malware or malicious Extensions on the device.
Check the algorithm and scope of use using primary sources
- NIST FIPS 180-4：Secure Hash Standard
- NIST：Hash Functions Policy
- MDN：SubtleCrypto.digest()
- OWASP：Password Storage Cheat Sheet
- Microsoft Learn：Get-FileHash
- GNU Coreutils：SHA-2 utilities
- OpenSSL Documentation：openssl-dgst
Prioritize NIST for algorithm definitions and migration policies, MDN and the Web Cryptography specification for browser APIs, OWASP for password storage, and official documentation for each OS command. Also check commands in articles against the help for the version you use.
Example: pass hello as UTF-8 to SHA-256
Enter hello with no line break in Text Mode and check the SHA-256 row in lowercase hex.
The same input, encoding, and algorithm produce the same 64-character hexadecimal value. Adding a trailing Enter produces a different value.
- Enter hello
- Select lowercase HEX
- Select "Generate hashes".
- Copy the SHA-256 row.
Use only dummy data for values included in articles or tests.
Frequently asked questions
- Is SHA-256 encryption?
- No. It is a Hash Function that produces a fixed-length Digest from input data. Its purpose and properties differ from encryption that decrypts original Data with a Key and from decodable Base64.
- If the Hash matches, is the File always safe?
- You can verify that content matches the expected Digest, but that does not automatically establish trust in the source that published the expected value or the distribution path. Also check the official distributor, HTTPS, signatures, and more.
- Can I use MD5 or SHA-1 for new purposes?
- It remains for Legacy compatibility checks but is not recommended for new Security uses. Unless specified otherwise, consider SHA-256 or higher and follow Protocol or distribution-source requirements.
- Is the input content sent to the Server?
- Current DevelopTools processes Text, File contents, generated Hashes, and expected Hashes in the Browser without sending them to external APIs.