Hash & Checksum
Compute the MD5, SHA-1, SHA-256 and SHA-512 of some text or a file, and check a download against the checksum its publisher listed. The file is read in your browser — it never leaves your device.
🔒 Processed locally — nothing is uploadedAny file — it's read locally, never uploaded
Related tools
A hash is a fixed-length fingerprint of some data. Change a single byte of the input and the hash changes completely, which is exactly what makes it useful for checking that a file arrived intact or that two things are identical.
Verifying a download
When a project publishes a release, it often lists a SHA-256 checksum next to the download (or a SHASUMS file). After downloading, drop the file here, paste that checksum into the "Verify" box, and the matching row lights up green if they're equal. If they don't match, the file is corrupted or has been tampered with — don't run it.
Which algorithm to use
- SHA-256 — the default choice for verifying downloads and signing. Use this unless told otherwise.
- SHA-512 — same family, longer output; sometimes required.
- SHA-1 — still seen for Git commit IDs and legacy checksums, but broken for security purposes since 2017.
- MD5 — fine as a non-security integrity check (many mirrors still list it) but trivially forgeable; never use it to prove authenticity.
Why doing this locally matters
Many "online hash" sites upload your file to their server to compute the hash. For a public release that's merely wasteful; for anything private it defeats the purpose. This tool uses the browser's built-in crypto.subtle.digest for the SHA family and a small in-page implementation for MD5, so the bytes are only ever read into memory on your machine.
Where you'll actually run into checksums
Verifying a single download is the most visible case, but the same idea runs through a lot of everyday software infrastructure. A Docker image's digest (sha256:9c27e...) pins one exact, immutable build, so docker pull can't silently hand you a different image later. Package managers like npm and pip record a hash per dependency in their lockfiles, so a fresh install fails loudly instead of quietly pulling a tampered or mismatched version. Git itself identifies every commit and file by a SHA hash, which is how it detects that history has been rewritten. Forensic and legal chain-of-custody work uses the same trick at a larger scale: hash a piece of evidence the moment it's collected, and any later dispute about whether it was altered comes down to comparing that one string.
Frequently asked questions
Is my file uploaded?
No. It's read into an ArrayBuffer in the page and hashed there. Nothing is transmitted.
Why isn't there a "SHA-3" or "CRC32" option?
The browser's crypto API only exposes SHA-1/256/384/512. SHA-3 and CRC32 would each need another bundled implementation; the four here cover almost every real checksum you'll meet.
Does hashing text include a trailing newline?
Only if you typed one. The text is hashed exactly as shown in the box, byte for byte in UTF-8.
Is there a file size limit?
The practical limit is your browser's memory, since the whole file is loaded at once. Multi-gigabyte files may fail; for those, use a command-line tool like sha256sum or shasum.
Can two different files ever produce the same hash?
In theory yes — a hash squeezes unlimited input into a fixed-length output, so collisions must exist somewhere. In practice, finding one for SHA-256 is computationally infeasible with any known method, which is exactly what makes it trustworthy for verification. MD5 and SHA-1 are different: practical collision attacks exist for both, which is why neither should be relied on to prove authenticity anymore.
Does the hash reveal anything about what's inside the file?
Not in general. A cryptographic hash is one-way — you can't work backward from the digest to recover the original content, and changing even one byte produces a completely different, unrelated-looking result. The one exception is content that can be guessed: someone who suspects what a short or predictable file or text contains can hash their guess and compare. For an ordinary software download, publishing the hash leaks nothing useful.