Password hash generator — SHA-256
Generate a SHA-256 hash of a password below, with an optional salt, and read on for exactly when SHA-256 is and isn't the right tool for storing real user passwords.
Why so many people search for this specifically
SHA-256 is familiar, fast, available in every programming language's standard library without an extra dependency, and it's what a lot of tutorials reach for first when explaining password hashing conceptually. That's exactly why it's worth being direct here: plain SHA-256 is a reasonable teaching tool for the concept of hashing, but it is not, by itself, a secure way to store passwords for a real system with real users.
The core problem: speed
SHA-256 is engineered to be fast — modern hardware can compute billions of SHA-256 hashes per second. That's a desirable property for checksumming a large file quickly, and a serious liability for a password column, because it means an attacker who steals a database of SHA-256 password hashes can attempt an enormous number of guesses per second against every single one, using cheap, widely available GPU hardware.
What to do instead, in order of preference
- bcrypt or Argon2 — purpose-built, deliberately slow, tunable password hashing functions. See our bcrypt generator.
- PBKDF2-HMAC-SHA256 — if you specifically need to stay within SHA-256, PBKDF2 applies it tens of thousands of times in a loop (an iteration count you control), which meaningfully slows down brute-force attempts while still being built entirely on SHA-256 under the hood. This is a NIST-approved construction (SP 800-132) and is what this page's generator approximates conceptually through its HMAC-SHA256 salting mode, though a real PBKDF2 implementation iterates far more times than a single HMAC call.
- Plain salted SHA-256 — better than nothing, but still fast enough that a single stolen hash can be brute-forced quickly with modern hardware. Only appropriate for low-stakes, non-production use cases.
If you're set on SHA-256, at least salt it
The generator above includes a salt field and an HMAC mode specifically so that if your constraints genuinely require SHA-256 (a legacy system, a specific compliance requirement, a course assignment asking for it explicitly), you're at minimum not storing an unsalted, rainbow-table-vulnerable hash. Use the HMAC mode over simple append/prepend concatenation — see our full SHA-256 with salt breakdown of why.
Strength meter included
Since this page is about actual passwords, it includes the same live strength meter as our main password hash generator — because no amount of hashing sophistication compensates for a genuinely weak, guessable password in the first place.
Frequently asked questions
Can I use SHA-256 to hash passwords in a small personal project?
For a low-stakes personal project with no real user data at risk, plain salted SHA-256 is a common shortcut — but the better habit, even for small projects, is to reach for a well-maintained bcrypt or Argon2 library, which are usually just as easy to install and use correctly.
What is PBKDF2 and how does it relate to SHA-256?
PBKDF2 is a key-derivation function that repeatedly applies an underlying hash — commonly SHA-256, hence "PBKDF2-HMAC-SHA256" — thousands of times in a loop, which multiplies the computational cost of each guess and makes brute-forcing meaningfully harder than a single unsalted SHA-256 call.
Why does this page include a salt field but the bcrypt page doesn't?
bcrypt generates and embeds its own salt automatically as part of the algorithm, while SHA-256 has no such built-in mechanism — any salting has to be added manually, which is exactly what this page's tool lets you do.