No. Reading and hashing both happen in the browser. Nothing remains once the tab is closed.

How large a file can it handle?

The browser's hashing API cannot process a file in chunks, so the whole file must be held in memory at once. Past roughly 500MB some devices will fail. If that happens, close other tabs and hash one file at a time.

The value does not match the publisher, but it should

A single differing byte changes everything, so check first that the pasted value is complete. Also hash the file exactly as downloaded — opening and re-saving it in an editor can change line endings or text encoding, and that changes the hash.

Can I use this to store passwords?

No. SHA-256 and similar hashes are designed to be fast, which is the wrong property for stored passwords. Use a purpose-built scheme with a salt and a tunable cost, such as bcrypt, scrypt or Argon2.

Why do the text box and the file give different values?

Browsers normalise every line break in a text box to LF. A file saved with CRLF line endings is genuinely different data, so it hashes differently. Use the file mode to check a file.

How should I verify a download?

Note the value from the publisher, hash the downloaded file here, and compare the two. ⚠️ Because the value and the file come from the same place, an attacker who controls that place can replace both. Verification protects against corruption in transit and against a copy from somewhere else — not against the publisher being compromised.

Is comparing the first and last few characters enough?

For catching accidental corruption, yes. Against deliberate tampering, no: an attacker can aim for a value whose visible ends match. When tampering is the threat, compare every digit — copy the value from here and diff it as text.

Can it hash a whole folder?

No. A hash maps one byte sequence to one value, and there is no agreed way to fold several files into one. To check a folder, archive it first and hash the archive — bearing in mind that archives embed timestamps, so rebuilding one from identical contents produces a different value.

What is a hash, exactly?

A fixed-length value derived from the whole input. The same input always gives the same value, and changing a single byte gives a completely different one. This makes it useful for confirming a file is intact and unchanged.

No. Encryption can be reversed with the key; a hash cannot be reversed at all. It cannot be used to keep contents secret.

Should I avoid MD5 and SHA-1?

It depends on the job. Collisions can be constructed deliberately, so neither can prove a file was not tampered with. Both are still fine for confirming a download did not corrupt in transit, or for matching the MD5 a publisher has printed. Where the choice is yours, use SHA-256.

Strictly it is an error-detecting checksum, the same one ZIP archives carry internally. It was designed to catch accidental corruption and cannot detect tampering.

SHA-256 is enough in practice. SHA-512 has a longer value and more theoretical headroom, but there is no prospect of SHA-256 falling. SHA-512 is faster on 64-bit hardware, which does not matter at the scale of checking a file. The reliable rule is to match whichever the publisher printed.

Two different inputs producing the same hash. With a fixed-length output they must exist. What matters is whether one can be **constructed deliberately** — for MD5 and SHA-1 that is a known technique, for SHA-256 it is not. "Collisions exist" and "collisions can be made to order" mean very different things for security.

Does the same file always give the same value?

Yes. Filename, timestamps and location are not part of the calculation — only the bytes of the content. Renaming changes nothing. Conversely, a document that looks identical hashes differently if re-saving rewrote an internal date.

Back to all tools／ Security

Hash and checksum verifier

Runs in your browserNothing is uploaded

Compute SHA-256, SHA-512, SHA-384, SHA-1, MD5 and CRC32 for files or text, and compare the result against a published value. Everything runs in your browser — nothing is uploaded.

Input

What are you hashing?

Text

Output

Nothing here yet

Paste the value published by whoever distributed the file and the comparison is made character by character. Checking by eye reliably misses a few changed digits in the middle.

All tools

Highlights

Computed in your browser: Reading and hashing both happen on your device, and files are never sent to a server. Files you could not upload elsewhere are fine to use.
Comparison is automatic: Paste the published value and it is compared with the computed one. The algorithm is identified from the length, and case, surrounding whitespace, separating colons and a trailing filename are ignored, so you can paste it as copied.
MD5 and SHA-1 carry a caution: Both have demonstrated collision attacks, so they are not suitable for detecting tampering. They can still be computed, since many download pages publish only an MD5, and the caution is shown on screen.

How to use it

Choose text or a file
Switch between the two at the top. Text goes straight into the box; files are dropped on the area or picked with a click.
Compute
Text is hashed as you type and all six values appear in the sheet. For a file, tick the algorithms you need and press "Compute hashes".
Compare with a published value
Open "Check against a published value" and paste the figure the download page prints. The algorithm is read from its length, and a mismatch marks the characters that differ.

About hashes

What is a hash, exactly?: A fixed-length value derived from the whole input. The same input always gives the same value, and changing a single byte gives a completely different one. This makes it useful for confirming a file is intact and unchanged.
Is this encryption?: No. Encryption can be reversed with the key; a hash cannot be reversed at all. It cannot be used to keep contents secret.
Should I avoid MD5 and SHA-1?: It depends on the job. Collisions can be constructed deliberately, so neither can prove a file was not tampered with. Both are still fine for confirming a download did not corrupt in transit, or for matching the MD5 a publisher has printed. Where the choice is yours, use SHA-256.
Is CRC32 a hash?: Strictly it is an error-detecting checksum, the same one ZIP archives carry internally. It was designed to catch accidental corruption and cannot detect tampering.
SHA-256 or SHA-512?: SHA-256 is enough in practice. SHA-512 has a longer value and more theoretical headroom, but there is no prospect of SHA-256 falling. SHA-512 is faster on 64-bit hardware, which does not matter at the scale of checking a file. The reliable rule is to match whichever the publisher printed.
What is a collision?: Two different inputs producing the same hash. With a fixed-length output they must exist. What matters is whether one can be **constructed deliberately** — for MD5 and SHA-1 that is a known technique, for SHA-256 it is not. "Collisions exist" and "collisions can be made to order" mean very different things for security.
Does the same file always give the same value?: Yes. Filename, timestamps and location are not part of the calculation — only the bytes of the content. Renaming changes nothing. Conversely, a document that looks identical hashes differently if re-saving rewrote an internal date.

Questions

Is my file uploaded?: No. Reading and hashing both happen in the browser. Nothing remains once the tab is closed.
How large a file can it handle?: The browser's hashing API cannot process a file in chunks, so the whole file must be held in memory at once. Past roughly 500MB some devices will fail. If that happens, close other tabs and hash one file at a time.
The value does not match the publisher, but it should: A single differing byte changes everything, so check first that the pasted value is complete. Also hash the file exactly as downloaded — opening and re-saving it in an editor can change line endings or text encoding, and that changes the hash.
Can I use this to store passwords?: No. SHA-256 and similar hashes are designed to be fast, which is the wrong property for stored passwords. Use a purpose-built scheme with a salt and a tunable cost, such as bcrypt, scrypt or Argon2.
Why do the text box and the file give different values?: Browsers normalise every line break in a text box to LF. A file saved with CRLF line endings is genuinely different data, so it hashes differently. Use the file mode to check a file.
How should I verify a download?: Note the value from the publisher, hash the downloaded file here, and compare the two. ⚠️ Because the value and the file come from the same place, an attacker who controls that place can replace both. Verification protects against corruption in transit and against a copy from somewhere else — not against the publisher being compromised.
Is comparing the first and last few characters enough?: For catching accidental corruption, yes. Against deliberate tampering, no: an attacker can aim for a value whose visible ends match. When tampering is the threat, compare every digit — copy the value from here and diff it as text.
Can it hash a whole folder?: No. A hash maps one byte sequence to one value, and there is no agreed way to fold several files into one. To check a folder, archive it first and hash the archive — bearing in mind that archives embed timestamps, so rebuilding one from identical contents produces a different value.

Input

Output

Related tools

Highlights

How to use it

Choose text or a file

Compute

Compare with a published value

About hashes

Questions