Obtain SHA-256 string of a string

Question

I have some string and I want to hash it with the SHA-256 hash function using C#. I want something like this:

 string hashString = sha256_hash("samplestring");

Is there something built into the framework to do this?

Solution 1

The implementation could be like that

public static String sha256_hash(String value) {
  StringBuilder Sb = new StringBuilder();

  using (SHA256 hash = SHA256Managed.Create()) {
    Encoding enc = Encoding.UTF8;
    Byte[] result = hash.ComputeHash(enc.GetBytes(value));

    foreach (Byte b in result)
      Sb.Append(b.ToString("x2"));
  }

  return Sb.ToString();
}

Edit: Linq implementation is more concise, but, probably, less readable:

public static String sha256_hash(String value) {
  using (SHA256 hash = SHA256Managed.Create()) {
    return String.Concat(hash
      .ComputeHash(Encoding.UTF8.GetBytes(value))
      .Select(item => item.ToString("x2")));
  }
} 

Edit 2: .NET Core , .NET5, .NET6 ...

public static String sha256_hash(string value)
{
    StringBuilder Sb = new StringBuilder();

    using (var hash = SHA256.Create())            
    {
        Encoding enc = Encoding.UTF8;
        byte[] result = hash.ComputeHash(enc.GetBytes(value));

        foreach (byte b in result)
            Sb.Append(b.ToString("x2"));
    }

    return Sb.ToString();
}

Solution 2

This is a much nicer/neater way in .net core:

public static string sha256_hash( string value )
{
  using var hash = SHA256.Create();
  var byteArray = hash.ComputeHash( Encoding.UTF8.GetBytes( value ) );
  return Convert.ToHexString( byteArray ).ToLower();
}

Comments

[daniel metlitski]

how would you decrypt the hash back into the password?

[Dmitry Bychenko]

@daniel metlitski: you can't: hash is one way function, you can compute hash but can't obtain the argument back. When registering a new user, store not password but its hash; on authentication, compute hash on the password provided and compare the hash with the stored hash.

[Dmitry Bychenko]

@JuliusHolmberg: you have to 1. Allocate resources (using), 2. Deal with bytes: Encoding as well as GetBytes 3. Represent the outcome as a string - StringBuilder and ToString("x2")

[El Mac]

This implementation seems wrong to me. That select Returns IEnumerable<string>. And you copy-pasted a terrible naming convention.

[Mikael Dúi Bolinder]

string.Join maybe?

[Dmitry Bychenko]

string.Concat is shorter and more readable: just concat without any delimiter

[jjthebig1]

This is actually the best answer just missing one function call. Here is what worked for me: return String.Concat((System.Security.Cryptography.SHA256.Create() .ComputeHash(Encoding.UTF8.GetBytes(value)) .Select(item => item.ToString("x2"))));

[jjthebig1]

I like it because it's single line and doesn't need a function by itself.

[Felipe Suárez]

I would NOT recommend to store passwords using a simple hash. Actually just use a library that has the logic to store passwords (like identity). Even though you can't "decrypt" back you can use a dictionary attack with millions of common passwords whose hash are known. In order to avoid this you need to use hash + salt. You also need to store the salt securely. And there is probably more than I'm missing security-wise. Please use a library instead of trying to store passwords yourself.