How to generate SHA-256 hashes in Python

Python's hashlib module provides SHA-256: import hashlib; hash = hashlib.sha256(b'Hello World').hexdigest(). For strings, encode first: hashlib.sha256('Hello World'.encode('utf-8')).hexdigest(). For large files, read in chunks: h = hashlib.sha256(); with open('file', 'rb') as f: for chunk in iter(lambda: f.read(8192), b''): h.update(chunk); print(h.hexdigest()). The update() method lets you hash data incrementally without loading everything into memory.

# Python — generate SHA-256 hash
import hashlib

# Hash a string
text = "Hello, World!"
hash_hex = hashlib.sha256(text.encode("utf-8")).hexdigest()
print(hash_hex)
# "dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f"

# Hash a file
def file_sha256(filepath):
    sha256 = hashlib.sha256()
    with open(filepath, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            sha256.update(chunk)
    return sha256.hexdigest()

print(file_sha256("document.pdf"))

Python HMAC-SHA256 for API authentication

Many APIs (AWS, Stripe webhooks, GitHub) use HMAC-SHA256 for request signing: import hmac; signature = hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest(). To verify a webhook: expected = hmac.new(key, payload, hashlib.sha256).hexdigest(); if hmac.compare_digest(expected, received_signature): # Valid. Always use hmac.compare_digest() instead of == to prevent timing attacks. For AWS Signature V4, Python's boto3 handles HMAC signing automatically.

SHA-256 for password hashing in Python

While SHA-256 is a secure hash, do NOT use plain SHA-256 for passwords — it is too fast and vulnerable to brute force. Use purpose-built password hashing: import bcrypt; hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt()). Or use hashlib.pbkdf2_hmac('sha256', password.encode(), salt, 100000) which uses SHA-256 internally with key stretching. For new projects, argon2-cffi is the recommended choice. Use this tool to generate SHA-256 hashes for checksums, data integrity, and non-password applications.