SHA-256 to Base64

How to get a SHA-256 hash in Base64

1. SHA-256 is selected under Algorithm; the other buttons switch to MD5, SHA-1, SHA-384 or SHA-512.
2. With Input on Text, type or paste into Text. Input is decides how that text is read: as UTF-8 text, or as hex or Base64 bytes if you want to hash binary data you already have in encoded form.
3. Copy the result as Hex, Base64 or Base64URL. All algorithms lists every digest of the same input.
4. To hash files, switch Input to File and drop one or several. Each file gets its own result. Above 200 MB, SHA-256 and MD5 are computed in 8 MB chunks with a progress indicator, so a large file never has to fit into memory at once.

The hash updates as you type. HMAC and SRI at the top switch to keyed hashes and Subresource Integrity tags.

Example hashes

The second and third rows are the trap behind most mismatches: one invisible newline gives a completely different hash. Text pasted into a browser text box also has its line endings turned into LF, so for files with CRLF line endings drop the file itself instead of pasting its content.

Where SHA-256 appears in Base64

Hex is the traditional way to print a digest, but many formats use Base64 because it is shorter:

• Content Security Policy hashes for inline scripts: script-src 'sha256-…'.
• Subresource Integrity: integrity="sha256-…", though SHA-384 is the more common choice there.
• HTTP Content-Digest (RFC 9530): Content-Digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=: for the body {"hello": "world"}. The colons mark a binary value in structured headers.
• Cloud storage checksums, such as the x-amz-checksum-sha256 header of Amazon S3, which carries the Base64 digest.
• Lock files and package managers: the integrity field in package-lock.json (usually sha512-…) and SRI-style hashes in Nix.

Docker and OCI image digests (sha256:…) and Git use hex. When you have to compare across systems, convert with hex to Base64 or Base64 to hex instead of hashing again.

SHA-256 Base64 in code and on the command line

printf 'hello' | openssl dgst -sha256 -binary | base64
sha256sum file.bin | cut -d' ' -f1 | xxd -r -p | base64

Without -binary, OpenSSL prints hex text, and Base64 of that text is 88 characters of nonsense.

import base64, hashlib

digest = hashlib.sha256(b"hello").digest()
print(base64.b64encode(digest).decode())

In Node.js, crypto.createHash("sha256").update("hello").digest("base64") returns the same LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=, and "base64url" gives the URL-safe form. A plain hash is not a signature: anyone can recompute it. To prove a message came from someone holding a key, use an HMAC. See Base64 in Python and OpenSSL for more.

FAQ