What Is a SHA-256 Checksum? Verify Text Fingerprints

SHA-256 is a fingerprint, not an encrypted message

A cryptographic hash function maps an arbitrary input to a fixed-size output. SHA-256 produces a 256-bit digest commonly displayed as 64 hexadecimal characters. It does not encrypt your text and cannot be decrypted to recover the source. SHA-256 is widely used to compare exact content and detect unexpected changes.

Try a known-answer example

Paste abc into Vyblet's text hashing tool, choose SHA-256 and Hex output. The expected result is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. This exact value is a useful test vector. Add a space to your input, and the resulting digest will differ completely.

What checksums can and cannot prove

If a downloaded document's hash matches a trusted hash published over a secure channel, it is evidence the bytes match. But if an attacker can alter both the file and its published hash, a plain checksum does not authenticate the source. A signed checksum, digital signature or authenticated channel is needed for provenance and authenticity. Hash comparisons also depend on comparing exact bytes, not just visually similar text.

UTF-8, line endings and hidden whitespace

The same visible letters can hash differently if the byte representation changes. A trailing newline, Windows versus Unix line endings, Unicode normalization or text encoded with a different charset can produce a different digest. For trustworthy comparisons, make sure both sides hash precisely the same bytes. This tool hashes UTF-8 text from the text input; it is not a file-upload checksum verifier.

SHA-256 versus HMAC-SHA256 versus AES

SHA-256 can detect a change when you already have a trusted reference. HMAC-SHA256 adds a shared secret, allowing authorized parties to verify message authenticity. AES-GCM encrypts data, which protects confidentiality and checks for modification. None of these three functions is a drop-in replacement for the others. For password storage, use a deliberately slow password-hashing scheme rather than plain SHA-256.

FAQ