Why SHA-256 changes when you add a space or newline

Start with a reproducible five-letter input

Open Hash Generator, choose SHA-256 and enter hello in lowercase with no quotes, spaces or line break. KitForma encodes the text as UTF-8 and hashes those bytes through Web Crypto. It does not append a newline. Copy the complete 64-character hexadecimal result for a comparison.

Now add one LF newline after the final letter and run it again. That is a six-byte input rather than a five-byte input. The result changes even though a text editor may show both versions as the same short word. The values below were checked with the same engine used by this tool.

hello (no newline):
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

hello followed by LF:
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03

Inspect the input before changing the algorithm

First check capitalization and leading or trailing spaces. Then check line endings: LF and CRLF have different byte sequences. Text copied into a browser field may not preserve the byte-for-byte representation of the original file, so this text tool is not a substitute for a file checksum utility.

For short strings, Text to Character Codes can expose the code points behind visually similar characters. For longer text, use Text Diff to find changed lines. Do not automatically trim, normalize or reformat the input when the purpose is to confirm exact equality; those operations change the thing being compared.

1. Use the same algorithm at both ends.
2. Compare the intended input, including the ending.
3. Copy the full digest, rather than only its first few characters.

Know what the digest does and does not establish

A matching expected digest is useful only when the expected value comes from a trustworthy source and was calculated over the same bytes. A hash displayed beside an untrusted download does not independently authenticate the publisher. KitForma’s text tool does not inspect downloads or verify signatures.

Hashing is not reversible encoding, and SHA-256 is not a password-storage recipe. The tool also offers SHA-384 and SHA-512; SHA-1 is labelled legacy. Input is limited to 200,000 UTF-16 code units and stays in the current browser operation. Use harmless examples when sharing screenshots or asking someone to reproduce a mismatch.