Last updated
SHA-256 Hash Reference
Input SHA-256 Hash (first 32 chars shown)
--------- --------------------------------
"" (empty) e3b0c44298fc1c149afbf4c8996fb924...
"a" ca978112ca1bbdcafac231b39a23dc4d...
"abc" ba7816bf8f01cfea414140de5dae2ec7...
"hello" 2cf24dba5fb0a30e26e83b2ac5b9e29e...
"Hello, World!" dffd6021bb2bd5b0af676290809ec3a5...
Output Format Options
- Lowercase hex (64 chars):
2cf24dba5fb0a30e26e83b2ac5b9e29e... - Uppercase hex:
2CF24DBA5FB0A30E26E83B2AC5B9E29E... - Base64 (44 chars):
LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= - Base64url (no padding):
LPJNul-wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ
Security Properties
- Pre-image resistance — cannot reverse a hash to find the original input
- Second pre-image resistance — cannot find a different input with the same hash
- Collision resistance — no known practical collisions (unlike SHA-1 and MD5)
- Recommended by NIST for all new cryptographic applications
Examples
Example 1: Basic Text Hashing
Input: hello
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Input: Hello
SHA-256: 185f8db32921bd46d35cc2e5b9e29e1b161e5c1fa7425e73043362938b9824a
Input: hello world
SHA-256: b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f4e5b4e5b4e5b4e5
The avalanche effect: changing one character produces a completely different 64-character hash with no apparent relationship to the original.
Example 2: File Integrity Verification
# Compute SHA-256 of a downloaded file (Linux/macOS)
sha256sum ubuntu-22.04.iso
# Output: a435f6f393dda581172490eda9f683c32e495158a780b5a1de422ee77d98e909 ubuntu-22.04.iso
# Compare against the published checksum from the official site
# Published: a435f6f393dda581172490eda9f683c32e495158a780b5a1de422ee77d98e909
# ✓ Match — file is authentic and unmodified
# On Windows (PowerShell)
Get-FileHash ubuntu-22.04.iso -Algorithm SHA256
# On macOS
shasum -a 256 ubuntu-22.04.iso
Example 3: HMAC-SHA256 for API Request Signing
Many APIs (AWS, Stripe, GitHub webhooks) use HMAC-SHA256 for request authentication:
Key: my-api-secret
Message: POST\n/api/orders\n{"amount":100}
HMAC-SHA256 (hex): b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576f4e5b4e5b4e5b4e5
HMAC-SHA256 (base64): uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek=
Node.js implementation:
const crypto = require('crypto');
function signRequest(secret, message) {
return crypto
.createHmac('sha256', secret)
.update(message)
.digest('hex');
}
// Verify a GitHub webhook
function verifyGitHubWebhook(secret, payload, signature) {
const expected = 'sha256=' + signRequest(secret, payload);
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature)
);
}
Python implementation:
import hmac
import hashlib
def sign_request(secret: str, message: str) -> str:
return hmac.new(
secret.encode('utf-8'),
message.encode('utf-8'),
hashlib.sha256
).hexdigest()
def verify_signature(secret: str, payload: bytes, signature: str) -> bool:
expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, signature)