SHA-256 File Hash Generator

SHA-256 file hash generator

Compute the SHA-256 checksum of any file. The file is hashed in your browser and never uploaded — no account, no size limit, and it works offline.

Choose a file or drop it hereAny file type, any size. Nothing is uploaded.

What this tool does

It computes the SHA-256 hash of any file — a 64-character fingerprint that is unique to that exact sequence of bytes. Change one pixel, one character, one byte, and the hash changes completely.

Everything happens in your browser. The file is read from disk with the Web Crypto API and never leaves your device. There is no upload, no account and no size limit beyond what your own machine can handle.

What a file hash is useful for

Verifying a download. Compare the hash you compute against the one the publisher lists. If they match, the file arrived intact and unmodified.
Detecting tampering. Record the hash of an important file now, and you can prove later whether it has changed.
Deduplication. Two files with the same SHA-256 are the same file, whatever they are named.
Proving a file existed. A hash identifies a file uniquely without revealing its contents, which is what makes it publishable.

How to check a hash on the command line

The values below will match what this page produces for the same file.

# macOS / Linux
shasum -a 256 yourfile.pdf

# Windows (PowerShell)
Get-FileHash yourfile.pdf -Algorithm SHA256

# Windows (cmd)
certutil -hashfile yourfile.pdf SHA256

From a hash to dated proof

A hash on its own proves nothing about when your file existed — you could compute it today for a file you make tomorrow. What gives a hash evidentiary weight is publishing it somewhere nobody can alter after the fact.

That is what blockchain timestamping does: it records this same SHA-256 fingerprint in a public Ethereum transaction. The record is permanent, publicly verifiable, and it proves the file existed no later than that block — while the file itself stays on your machine. Only the hash is ever published.

Worth being precise about what that establishes: it proves existence and integrity, not authorship. See proof of existence vs proof of authorship for where the line falls.

About SHA-256

SHA-256 is part of the SHA-2 family published by NIST in 2001 and is the hash function securing, among many other things, the Bitcoin blockchain. It produces a 256-bit output regardless of input size, is deterministic, and is designed so that finding two different files with the same hash is computationally infeasible. No practical collision has ever been found.

Frequently asked questions

Is my file uploaded anywhere?

No. The file is read and hashed entirely in your browser using the Web Crypto API. It is never sent to our servers or to anyone else, and you can confirm that by opening your browser network tab while hashing — there is no request. The tool also works with your connection turned off.

How do I find the SHA-256 hash of a file?

Drop the file onto the box above and the 64-character hexadecimal hash appears immediately. On the command line you can get the same value with shasum -a 256 filename on macOS or Linux, or certutil -hashfile filename SHA256 on Windows.

How long is a SHA-256 hash?

A SHA-256 hash is 256 bits, which is 32 bytes. Written in hexadecimal — the usual form — that is exactly 64 characters, each one 0-9 or a-f.

Can a SHA-256 hash be reversed or decrypted?

No. SHA-256 is a one-way function, not encryption. There is no key and nothing to decrypt. Given a hash you cannot recover the file; the only way to find matching input is to guess it and hash the guess, which is infeasible for anything but trivially short inputs.

Will the same file always give the same hash?

Yes. SHA-256 is deterministic, so identical bytes always produce an identical hash on any machine and in any tool. Changing a single bit produces a completely different hash, which is what makes it useful for detecting tampering.

What is the difference between a hash and a checksum?

They serve the same purpose — detecting change — but at different strength. Simple checksums like CRC32 catch accidental corruption and are easy to fool deliberately. SHA-256 is a cryptographic hash: it is designed so that nobody can construct a different file with the same hash.