SHA-256 Hash Generator

The general Hash Generator computes five algorithms at once (MD5, SHA-1, SHA-256, SHA-384, SHA-512) in hex only — built for 'I don't know which algorithm the checksum uses, show me all of them.' This page does one thing: SHA-256 (and HMAC-SHA256) in either hex or Base64, for the common case where you already know you need SHA-256 and want the right text encoding without scrolling past four other digests. Need MD5 or SHA-512 too? The Hash Generator computes all of them side by side.

They're the same 32 bytes written two different ways — hex uses 64 characters (0-9, a-f), Base64 uses about 44. Release checksums and git/Docker content hashes almost always use hex; some HTTP signature and content-integrity conventions (and several webhook providers) use Base64 instead, because it's shorter. If a header or field you're matching against looks like a mix of upper and lower case letters, digits, +, / and possibly a trailing =, it's Base64, not hex — switch the toggle before pasting it into the compare field.

Base64 is case-sensitive — unlike hex, 'A' and 'a' are different characters in a Base64 string, so this page never uppercases or lowercases Base64 output or your pasted comparison value (the A–F case toggle only applies in Hex mode). Paste the Base64 value exactly as published, including a trailing = padding character if it has one.

Turn on HMAC mode, paste the exact raw request body the provider signed (whitespace and all — a single re-formatted space breaks the match), enter the shared secret, and compare the result to the signature header. The encoding varies by provider: some send the signature as hex (often prefixed, e.g. sha256=<hex>), others as Base64 — pick the matching output mode here before comparing. If nothing matches, the most common cause is comparing against a re-serialized copy of the payload rather than the exact bytes that were signed.

Yes — unlike MD5 and SHA-1, SHA-256 has no known practical collision or preimage attack and is the digest NIST and virtually every security standard currently recommends. It's the algorithm behind Bitcoin's proof-of-work, TLS certificate fingerprints, and most modern release-checksum and webhook-signature schemes precisely because it has held up.