SHA-256 versus MD5 versus password hashing
SHA-256 is a cryptographic hash function in the SHA-2 family. It outputs 256 bits. In 2026 it remains appropriate for content integrity, many signature schemes (as the hash inside them), and Bitcoin-style fingerprints. It is not “broken” the way MD5 and SHA-1 are for collisions.
It is still a fast hash. Fast is bad for storing passwords: attackers can try billions of guesses per second on GPUs. Password storage needs a memory-hard, slow function (Argon2id, scrypt, bcrypt) and a unique salt per user. Do not hash passwords with SHA-256 and call it done. HMAC-SHA256 is for keyed integrity, not for a password file either unless you know why you are using it.
ToolPin SHA-256 Hash computes the digest in your browser with Web Crypto or an equivalent local implementation. Nothing is uploaded. The tool is free and needs no account. Use MD5 Hash only when a legacy checksum demands MD5.
Output format
Expect 64 hexadecimal characters. Uppercase versus lowercase does not change the value; compare case-insensitively. Some tools show Base64 of the raw 32 bytes — that is a different presentation of the same digest.
The function is deterministic. Same UTF-8 bytes → same hash. A trailing newline will change it. Hash files with a file tool if you need to match shasum; this page hashes the text in the box.
You cannot reverse SHA-256 to get the original text. Brute force only works for short, low-entropy secrets. That is why it must not be your password scheme.
Privacy
Local hashing lets you fingerprint sensitive documents without sending them to an online hasher. Do not paste real passwords. Do not assume the hex string is anonymous if the input was guessable.
After you hash
If you are verifying a download, compare the hex to the publisher’s SHA-256, not MD5. If you are designing an API, hashing the body with SHA-256 can detect accidental corruption; use HMAC or signatures when an attacker is in the threat model.
ToolPin does not store hashes or inputs. For QR codes of a URL, use the QR tool — hashing a URL is unrelated to encoding it as an image.
Integrity versus authenticity
A SHA-256 digest tells you whether two byte strings match. It does not tell you who produced the string. An attacker who can change the file can also publish a new hash. Authenticity needs a signature (or HTTPS from a trusted host) in addition to the hash. Publishers who list SHA-256 sums on the same site that hosts the download are only helping with accidental corruption, not a full supply-chain guarantee.
When you compare hashes, copy both hex strings into a text editor and compare, or use a known-good command on your machine. Case and whitespace are the usual false mismatches.
Use the MD5 tool on ToolPin only when a legacy checklist still names MD5. For anything new, SHA-256 is the fingerprint to reach for — and a password KDF is what you reach for when the input is a user password.