How to hash text with SHA-256 (and other SHA-2)
Browser SubtleCrypto digests for checksums — not encryption, not bcrypt, and not HMAC unless you add a key on the HMAC page.
A hash is a fingerprint
Hash Generator at /tools/hash-generator runs SHA-1, SHA-256, SHA-384, or SHA-512 on the UTF-8 bytes of your input and prints lowercase hex. Same input always yields the same digest. SHA-256 is the default for checksums. SHA-1 is weak for new security uses; keep it for legacy compare-only. Changing one character changes the digest completely. This is not reversible “decoding.”
Steps
1) Open Hash Generator. 2) Paste the exact bytes you intend to fingerprint — trailing newlines count. 3) Choose SHA-256 unless a spec names another algorithm. 4) Copy the hex. The article page updates as you type. Compare with a published checksum by eye or with Text Diff if you wrap both in files.
Hash vs HMAC vs bcrypt vs Base64
HMAC Generator at /tools/hmac-generator also needs a secret key (webhook signatures). Bcrypt Hash / Verify at /tools/bcrypt-hash is for passwords (slow by design). Base64 Encode is encoding, not hashing — anyone can decode it. JWT Encoder wraps HMAC in a three-part token. Use the page that matches the spec you were given.
Worked example
The UTF-8 string “hello” hashed with SHA-256 is a well-known teaching digest (starts with 2cf24d…). If your file on disk used CRLF and the paste used LF, the hashes will not match — that is the usual support ticket. Do not hash a password with SHA-256 and store it; use bcrypt (or the server’s chosen KDF).
Limits
No MD5. No file-hash of a path on disk unless you paste the file contents. Large pastes may strain the tab. Hex output only on this page. Related: Hex Encode / Decode if you need to view raw bytes as hex rather than a digest.
Privacy
Input stays in the browser. Related: /tools/hmac-generator, /tools/bcrypt-hash, /tools/base64-encode. Close the tab after checksumming a secret-bearing document.