SHA-256 Hash Generator

SHA-256 is a member of the SHA-2 family of hash functions, designed by the NSA and published by NIST in 2001 (FIPS 180-2). It takes input of any length and produces a 256-bit digest, written as 64 hexadecimal characters. Since publication it has accumulated over two decades of public cryptanalysis without a practical attack surfacing — the reason it’s become the default general-purpose hash across most of the modern software ecosystem, not just one option among many.

That ubiquity is worth being specific about, because it’s not a coincidence: TLS certificate fingerprints are SHA-256. Git’s newer object-hashing format moved to SHA-256 specifically to get away from SHA-1 (broken since 2017). Bitcoin’s proof-of-work and block hashing run on SHA-256, twice, for every block. Package managers — npm’s package-lock.json, pip’s hash-checking mode — record SHA-256 (or the closely related SHA-512) digests to verify a downloaded package matches exactly what the registry published, catching both accidental corruption and deliberate tampering with a single check, unlike MD5’s checksum-only guarantee. Docker image digests are SHA-256. When in doubt about which hash to reach for on a new project, SHA-256 is the reasonable default precisely because it’s what nearly everything else already assumes.

Most modern CPUs — from recent x86-64 chips to Apple Silicon to current ARM server processors — include dedicated instruction-set extensions that compute SHA-256 in hardware, which is part of why it outperforms algorithms without that same widespread acceleration despite comparable theoretical cost. Combined with its output being large enough that a brute-force search for a collision is completely infeasible with any hardware that exists or is likely to exist, SHA-256 is the algorithm to reach for whenever you don’t have a specific reason to pick something else — legacy compatibility (MD5, SHA-1) or a specific need for SHA-512’s larger digest being the two real exceptions.

Computing a SHA-256 hash programmatically

JavaScript, using the browser’s native Web Crypto API (SubtleCrypto) — no library needed:

async function sha256(text) {
  const data = new TextEncoder().encode(text);
  const digest = await crypto.subtle.digest("SHA-256", data);
  return Array.from(new Uint8Array(digest))
    .map((b) => b.toString(16).padStart(2, "0"))
    .join("");
}

sha256("wanodev-release-v1.0.0").then(console.log);
// "da5b8cdc5f47d29b36579a02b2010ba264b6024c154c3d47f50f3452115441e4"

Python, via the standard library’s hashlib:

import hashlib

digest = hashlib.sha256("wanodev-release-v1.0.0".encode("utf-8")).hexdigest()
print(digest)
# "da5b8cdc5f47d29b36579a02b2010ba264b6024c154c3d47f50f3452115441e4"