How To Generate A SHA-256 Checksum From Text
3 min read
A hash is a fingerprint for data. Run text through SHA-256 and you get a fixed-length digest, and a small change in the input normally produces a very different digest. That sensitivity makes hashes useful for verification: confirming that what you received matches what was sent. No hash makes collisions impossible in principle, which is one reason algorithm choice matters, as the SHA-1 section below covers.
The Checksum Workflow
The everyday use is comparison. A project publishes a checksum alongside a download or a piece of text. You hash your copy yourself and compare the two strings. Match: strong evidence the two inputs agree. Mismatch: something differs, possibly by as little as a byte.
The comparison is the whole test, and its strength depends on where the reference checksum came from. A matching SHA-256 checksum is strong evidence your copy matches the referenced bytes; it does not establish that the source is trustworthy. A checksum from an independent channel carries more weight.
For actual files rather than pasted text, use your operating system's own hashing tools, because a text box hashes what you paste, bytes of a file are a different input.
Why SHA-256 And Not SHA-1
SHA-1 still appears on older download pages, and comparing against a published SHA-1 checksum is a reasonable legacy use: that's checking integrity against the publisher's own value.
What SHA-1 shouldn't do is protect anything. Researchers have produced colliding SHA-1 inputs, two different files with the same hash, so for any decision where someone might deliberately craft data to match, use SHA-256 or stronger. Collisions are a deliberate-attack concern; don't read "SHA-1 exists" as "any change is guaranteed to show."
Hashes Are Not Encryption And Not Secrets
A hash is one-way: you can't recover the original from the checksum. But one-way isn't secrecy. Anyone can hash a guessed input and compare, which is how short or predictable values fall out of hashes, and why passwords get dedicated password-hashing algorithms instead of plain SHA-256. Think twice before publishing a hash of anything sensitive or guessable.
Hash Some Text Now
The Hash Generator on DigitalDecided shows four algorithms for text you paste: SHA-1, SHA-256, SHA-384 and SHA-512. It hashes the pasted text as UTF-8; there is no file input, so hash files with your OS tools instead. The page's own note matches the guidance above: SHA-1 is there for legacy checksum comparisons, SHA-256 or better for anything that matters.
Paste the text, compare the string against a reference you trust, and read a match as strong evidence the copies agree, remembering that the checksum says nothing about whether the source itself was safe or genuine.