FreeMyTools

SHA256 Hash Generator for Excel: Formula, Power Query & URL Decode

Hash a column with SHA-256, SHA-1 or MD5, or encode/decode a URL — no VBA required.

Computed in this browser tab · nothing is sent anywhere

Paste a Whole Column of Values

Blank lines are hashed too, as an empty value, so a gap in your source column stays a gap in the result — nothing shifts up to fill it.

Keyboard Shortcuts ?
  • Copy Result C
  • Switch Hash / URL Mode M
  • Toggle This Guide ?
  • Toggle Dark Mode D
  • Focus Primary Input /
  • Clear or Close Esc

Why =SHA256(A1) Returns #NAME? in Excel

There is no hash function in the Excel formula language, and there never has been. Type =SHA256(A1), =SHA1(A1) or =MD5(A1) into any version of Excel — desktop, Mac, or the web app, current Microsoft 365 build included — and every one of them returns #NAME?, Excel's answer for a function it simply does not recognise. That is not a version gap that a future update might close; hashing has never been part of the worksheet engine, and the 2023–2025 wave of additions (dynamic arrays, native REGEXEXTRACT) did not touch it either.

Search for a fix and the answer is almost always a VBA class module wired to System.Security.Cryptography or the older CryptoAPI. It works, on a machine where the macro is allowed to run — and that clause is doing a lot of work. This tool exists so you can get the hash first and worry about macros never.

The Power Query M-Code Alternative

Power Query is the one native-adjacent path that actually reaches a hash without VBA, and almost nobody finds it, because it means knowing Power Query exists as more than an import tool, then knowing which of its hundreds of M functions is the one you need. It's there since 2016 either way. With the column highlighted, open Add Column → Custom Column in the ribbon and drop in the built-in cryptography wrapper: 

= Binary.ToText(
    Crypto.CreateHash(CryptoAlgorithm.SHA256, Text.ToBinary([Value])),
    BinaryEncoding.Hex
  )

Swap CryptoAlgorithm.SHA256 for CryptoAlgorithm.SHA1 for the shorter digest; there is no MD5 option in that enum, which is one more small reason MD5 belongs to legacy matching and nothing newer. The step loads back to the sheet as an ordinary column of text once you close and load — no macro, no .xlsm, and it survives a locked-down Trust Center the same way the Power Query route on this hub's other Excel tools does.

What the VBA Class Module Actually Costs You

The macro answer isn't wrong, it's fragile in a specific, predictable way. A hashing class module has to import a cryptography provider, wire up byte arrays by hand, and then survive three separate gatekeepers before it runs at all: Trust Center macro settings (disabled without notice on most managed tenants), the Mark of the Web (blocks macros outright on anything that arrived by email or download since 2022, with no override inside Excel), and the file extension itself — a macro-bearing file must be saved as .xlsm rather than the plain .xlsx everyone expects, and quite a few upload portals bounce that extension outright. None of that shows up as an error message. The macro is simply skipped, silently, and the cell next to it stays blank.

A hash also isn't a one-off lookup the way a Base64 blob or a hex colour often is — it's usually a reconciliation step run against hundreds of rows every time a report refreshes. A macro that a colleague's machine quietly refuses to run turns that into a recurring support ticket rather than a one-time inconvenience.

Hashing a Whole Column Without Losing a Row

The batch panel above is built for the actual job people bring to this page: a column of order numbers, emails, or record IDs that needs to become a column of hashes for a dedupe check or an integrity comparison against a previous export. Paste the values in, pick an algorithm, and the hashes come back in the same order, one per line — a blank line in the source stays a blank row in the result rather than being skipped, which matters because a skipped row silently shifts every hash below it up by one and pairs every remaining row with the wrong source value.

To check the tool independently rather than trusting it blindly: SHA-256 of an empty value is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, on any correct implementation anywhere, which is a fast way to confirm nothing has been altered before you commit to hashing a real column.

Why ENCODEURL Works on Windows and Fails Silently on Mac

Unlike hashing, Excel does have a native URL-encoding formula — ENCODEURL, shipped in 2013 — and it is the source of a different, quieter problem. It runs correctly in Excel for Windows. On Excel for Mac and Excel for the web, it either errors or produces nothing useful, because Microsoft added the function to the Windows formula engine and never brought the other two platforms up to match. A workbook built and tested on a Windows machine can hand a Mac colleague a broken cell with absolutely no indication that the formula itself is platform-specific rather than wrong.

Encoding a value here sidesteps the platform question entirely — the box above uses the same encoding rule the browser itself uses (encodeURIComponent), which turns a space into %20 rather than a plus sign. The plus-sign convention belongs to form submissions (application/x-www-form-urlencoded), a different encoding rule for a different context; mixing the two is a common source of a URL that looks encoded but silently means the wrong thing to whatever reads it next.

Decoding a URL in Excel: The Function That Was Never Built

Encoding has a native formula. Decoding does not — not on Windows, not on Mac, not on the web, and not in Google Sheets either, which has its own ENCODEURL but the identical absence on the way back. Both major spreadsheet platforms can turn readable text into a percent-encoded string with one formula, and neither can reverse that operation with any formula at all. Every forum thread on the question — a MrExcel thread titled plainly "How to Decode in Excel," an ExcelForum thread marked solved only because someone supplied a VBA loop — ends at a macro, the same dead end as the hash question above.

Take a value like coffee%20shop%20%26%20cream, exactly what ENCODEURL would have produced from coffee shop & cream. Switch the panel above to Decode and it comes back exactly as it started — readable text, spaces restored, the ampersand un-escaped — which is the one step neither spreadsheet program has ever shipped a formula for.

Getting the Edge Cases Right

Three things break a naive decoder, and all three are handled deliberately here rather than left to crash or guess:

A stray percent sign from ordinary text

A cell that reads 50% off is not encoded data, it's a percentage followed by text, and a strict decoder that assumes every % starts a two-digit hex pair will throw on it. Decoding here only touches sequences that are genuinely two valid hex digits after the %; anything else, including a lone %, passes through exactly as typed.

A value that's already been decoded once

Some exports encode a value twice on the way out — once by the system that built it, again by whatever pipeline handed it to you. Decoding that once still leaves % sequences sitting in the result. Rather than silently deciding how many times to unwrap it, the tool flags that case and shows what a second pass would produce, so you can confirm it's actually double-encoded before applying it — a single value that happens to contain a literal %2X shouldn't get mangled by a decoder that assumes it always needs to run twice.

Query-string plus signs

A URL built by hand often uses + for a space in the query string, a leftover convention from HTML forms rather than the URL specification itself. The decode panel has a checkbox for exactly that case — off by default, because turning every literal plus sign into a space by default would silently corrupt any value where a plus was actually meant.

Frequently Asked Questions

How do I hash a column in Excel?

Paste the column into the batch box below, pick SHA-256, SHA-1 or MD5, and copy the result column straight back into your sheet — it comes back in the same order, one hash per row, so it drops next to the source column with no realignment needed. There is no worksheet formula that does this; the batch box is the closest thing Excel has to one.

Is there a SHA256 formula in Excel?

No. Type =SHA256(A1) into any version of Excel, including current Microsoft 365 builds, and you get #NAME? — Excel does not recognise the function because it was never shipped. There is no SHA1, no MD5, no HASH of any kind in the worksheet formula language. This has been true since Excel's formula engine was written and nothing in the 2023–2025 function additions (dynamic arrays, native regex) touched it.

Why do I get #NAME? when I try to hash a cell?

#NAME? is Excel's answer for any function name it doesn't recognise, and that is the entire explanation here — SHA256, SHA1 and MD5 were never added to the formula language, so the parser has nothing to match your text against. It is not a syntax mistake on your part; there is genuinely no function to call correctly.

How do I decode a URL in Excel?

There's no built-in way — paste the encoded value into the URL panel above, switch to Decode, and copy the plain text back. Excel ships ENCODEURL for the encode direction but has never shipped anything that reverses it, on Windows, Mac, or the web version, in any Excel release to date.

Why doesn't ENCODEURL work on my Mac?

It's a platform gap, not a bug in your formula. ENCODEURL runs correctly on Excel for Windows but returns an error or simply fails on Excel for Mac and Excel for the web — Microsoft added the function to the Windows formula engine in 2013 and never extended it to the other two. A workbook built and tested on Windows can hand a Mac user a broken cell with no warning that anything is platform-specific.

Is there a way to hash data in Google Sheets?

Not as a built-in formula — Sheets has exactly the same gap as Excel, with no SHA256, SHA1 or MD5 function anywhere in its function list. Apps Script can reach a hash through Utilities.computeDigest(), but that means opening the script editor and writing code, which most spreadsheet users never do. The tool above works the same way regardless of which spreadsheet you're pasting into or out of.

Does Google Sheets have ENCODEURL and a decode function?

It has ENCODEURL, matching Excel's Windows behaviour, but no decode function at all — that half of the gap is identical on both platforms. A value encoded in Sheets and pasted into Excel, or the reverse, decodes correctly here regardless of which one produced it, since percent-encoding itself is a shared web standard, not a spreadsheet-specific format.

Is MD5 safe to use for this?

Not for anything security-related — MD5 has been considered broken since 2004 and collisions can be manufactured deliberately. It's offered here purely for compatibility: matching a hash a legacy system already produced, or checking a value against an old export that was hashed with MD5 before anyone had a choice. For a new reconciliation, dedupe check, or integrity flag, use SHA-256.

Will hashing the same value twice give the same result?

Always, character for character — that's the entire property that makes a hash useful for spotting duplicates or verifying a value hasn't changed. Trailing whitespace and case do matter, though: "ORD-4471" and "ord-4471 " hash to two completely different strings, so trim and standardise case in the sheet before hashing if you're comparing across two exports.

Why does decoding a URL sometimes produce garbled or doubled percent signs?

Usually because the value was encoded twice before it reached you — once by the system that built it, again by whatever exported it to your spreadsheet. Decoding it once then still shows %-sequences in the result; this page flags that case and offers a second decode pass, rather than mangling the value by guessing how many times to run it automatically.

Does a decode here crash on a stray % from ordinary text?

No — a percent sign that isn't followed by two hex digits (a price like "50% off", for instance) is left exactly as typed rather than raising an error. Only genuine %XX sequences get decoded; anything that doesn't match that pattern passes through untouched, so decoding a mixed column of real values and plain text is safe.

Is any of this sent to a server?

No — both the hashing and the URL encoding run in JavaScript inside your browser tab, and there's no upload step anywhere in the page for you to trigger even by accident. That matters more for the URL box than it might seem: a query string pasted in for decoding often carries an API key or a session token, and those shouldn't leave your machine to be decoded.

Related Tools