// tool reference · Platform & Learning
SHA-256 / HMAC Free
Compute SHA-256 digests and HMAC signatures.
What it does
Computes SHA-256 digests and HMAC signatures — for verifying a download, comparing an IOC hash, or debugging a webhook signature.
When to use it
- Verifying file integrity; debugging an HMAC that will not validate.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| text | textarea | required | Input to hash. |
| hmac_key | text | optional | Key — supply it to compute an HMAC rather than a plain digest. |
What you get back
The digest or signature.
Worked example
Input
text = hello world hmac_key = (empty)
Output (abridged)
SHA-256 b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 With hmac_key = 'secret': HMAC-SHA256 734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a A digest proves INTEGRITY. An HMAC proves integrity AND AUTHENTICITY -- anyone can compute a SHA-256; only a key holder can compute the HMAC. That is why webhook signatures are HMACs. Compare digests with a constant-time function, not '=='. String comparison leaks timing.
How it works
Deterministic. Local.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
SHA-256 is a hash, not encryption -- it is one-way and cannot be reversed by design. Never use a bare SHA-256 for passwords; use bcrypt or argon2.
Privacy
Nothing is stored.
Standards
FIPS 180-4 (SHA-2)RFC 2104 (HMAC)