Kit — hashes

Hash and checksum verifier

Check that a download arrived intact and matches the value its publisher printed — entirely in your browser. SHA-256, SHA-512, SHA-384, SHA-1, MD5 and CRC32, with the comparison done for you: paste the expected value and the algorithm is identified from its length.

Nothing here yet

Case, surrounding whitespace, separating colons and a trailing filename are all ignored. The algorithm is identified by length (8 = CRC32, 32 = MD5, 40 = SHA-1, 64 = SHA-256, 96 = SHA-384, 128 = SHA-512).

This runs entirely in your browser. Nothing is uploaded.

Related tools

Password generatorWord & character countJSON formatter & validatorBase64 encode & decodeAll tools

How this one is built

The file is never uploaded

Most online hash calculators send the file to a server and hash it there. This reads and hashes it in the page, so material you could not upload — work files, personal data — is still fair game.

Nobody should eyeball 64 hex characters

Paste the expected value and the verdict is stated plainly. The algorithm is identified from the length, and case, surrounding whitespace, separating colons and a trailing filename are all ignored, so a value copied straight off a download page just works.

It says where MD5 and SHA-1 stand

Both have demonstrated collisions. Plenty of download pages still publish nothing but an MD5, so both are offered — alongside a plain statement that they can confirm a match but cannot detect deliberate tampering.

Reading the result

What is a hash, exactly?A fixed-length value derived from the whole input. The same input always gives the same value, and changing a single byte gives a completely different one — which is what makes it useful for confirming a file is intact and unchanged.
Is this encryption?No. Encryption can be reversed with the key; a hash cannot be reversed at all. "We hashed it" is not the same claim as "we encrypted it", and hashing is no way to keep contents secret.
Should I avoid MD5 and SHA-1?It depends on the job. Collisions can be constructed deliberately, so neither can prove a file was not tampered with. Both are still fine for confirming a download did not corrupt in transit, or for matching the MD5 a publisher happens to have printed. Where the choice is yours, use SHA-256.
Is CRC32 a hash?Not really — it is an error-detecting checksum, the same one ZIP archives carry internally. It was designed to catch accidental corruption and offers nothing against tampering.

Questions

Is my file uploaded?

No. Reading and hashing both happen in the browser, and nothing survives closing the tab.

How large a file can it handle?

The browser's hashing API cannot process a file in chunks, so the whole file must be held in memory at once. Past roughly 500MB some devices will fail. If that happens, close other tabs and hash one file at a time.

The value does not match the publisher, but it should

A single differing byte changes everything, so check first that the pasted value is complete. Also hash the file exactly as downloaded — opening and re-saving it in an editor can change line endings or text encoding, and that changes the hash.

Can I use this to store passwords?

No. SHA-256 and friends are designed to be fast, which is precisely the wrong property for stored passwords. Use a purpose-built scheme with a salt and a tunable cost — bcrypt, scrypt or Argon2.

Why do the text box and the file give different values?

Browsers normalise every line break in a text box to LF. A file saved with CRLF line endings is genuinely different data, so it hashes differently. Use the file mode to check a file.