How to use Hash generator and checksum checker
- Choose Text or A file.
- Type text, or choose any file. Every hash is calculated straight away.
- To check a download, paste the checksum from its download page and read whether it matches.
Checking a download
Software publishers often list a checksum next to a download: a long string of letters and numbers labelled SHA-256. If the file you downloaded produces the same checksum, it is exactly the file they published, not damaged in transit and not swapped for something else. Choose the file here, paste the published checksum into the comparison box, and the tool tells you whether it matches and which algorithm it matched.
The comparison ignores capital letters, spaces and a leading sha256: label, so you can paste the value as it appears on the page.
Which algorithm
SHA-256 is the standard choice today and what most publishers use; SHA-384 and SHA-512 are longer members of the same family. SHA-1 and MD5 are still shown because older download pages publish them, and they work fine for spotting accidental damage. Both are broken for security: attackers can make two different files with the same MD5 or SHA-1, so never rely on them to prove a file is genuine or to protect passwords.
How it works
SHA hashes are calculated with WebCrypto, built into your browser; MD5, which WebCrypto doesn't offer, is implemented in this page and checked against the official test vectors. Text is hashed as UTF-8, so the result matches command-line tools such as sha256sum and shasum for the same text.
Files are read and hashed in your browser and never uploaded, which is the point when you're checking a file you don't trust yet. The whole file is read into memory, so files of a few gigabytes are the practical limit.
Examples
The text abc has the SHA-256 hash ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad and the MD5 hash 900150983cd24fb0d6963f7d28e17f72. Change one letter and the hash changes completely, which is why a matching checksum is strong evidence that two files are identical down to the last byte. The same text always produces the same hash, on any computer.
Questions
- Is my file uploaded?
- No. The file is read and hashed in your browser. That's the point of a checksum tool: you're checking a file you don't yet trust, without sending it anywhere.
- Which hash should I use?
- SHA-256 for anything new. MD5 and SHA-1 are shown because older download pages still publish them, but both are broken for security purposes and shouldn't be used to protect anything.
- How big a file can it hash?
- The file is read into memory, so a few gigabytes is the practical limit on most computers.