How to use it
- Choose Text or File.
- Type the text, or drop a file (up to 1 GB).
- Copy the hash you need, in lowercase, uppercase or Base64.
- To verify a download, paste the published checksum into the compare box.
What a hash is
A cryptographic hash function turns any input, a word or a 4 GB disk image, into a short fixed-length fingerprint. The same input always gives the same hash, and changing even one bit changes the hash completely. For example, the SHA-256 of The quick brown fox jumps over the lazy dog starts with d7a8fbb3, while adding a period at the end gives a hash starting with ef537f25.
Good hash functions are one-way: you cannot recover the input from the hash. This tool calculates five common algorithms at once, all in your browser. Even large files are read locally and never uploaded.
Verify a download checksum
Software publishers, Linux distributions and firmware vendors often list a SHA-256 checksum next to the download. To verify a file:
- Switch to File and drop the downloaded file.
- Copy the checksum from the official download page.
- Paste it into the Compare box.
If it matches, the matching algorithm is highlighted and the tool confirms the file is byte-for-byte identical to the one the checksum was made from. If nothing matches, the download is corrupted or not the same file; download it again from the official source. Upper or lower case and spaces in the pasted checksum do not matter, and Base64-encoded checksums are recognized too.
Which algorithm to use
| Algorithm | Length (hex) | Status |
|---|---|---|
| MD5 | 32 characters | Broken for security; fine for quick integrity checks |
| SHA-1 | 40 characters | Broken for security (collisions shown in 2017) |
| SHA-256 | 64 characters | Secure, the most common choice today |
| SHA-384 | 96 characters | Secure, part of the SHA-2 family |
| SHA-512 | 128 characters | Secure, often faster than SHA-256 on 64-bit CPUs |
For anything new, choose SHA-256. MD5 and SHA-1 still appear in older checksums and in non-security uses like cache keys and deduplication, which is why they are included.
Hashes and passwords
Do not store passwords as plain SHA-256 or MD5 hashes. These algorithms are designed to be fast, so attackers can test billions of guesses per second against a leaked database. Password storage needs a deliberately slow, salted algorithm such as Argon2id, bcrypt, scrypt or PBKDF2, which your framework or identity provider should handle for you.
A plain hash also does not prove who created a file. For that you need a digital signature or an HMAC with a secret key. If you work with signed tokens, the JWT decoder can verify HMAC signatures.
Text encoding matters
A hash is calculated over bytes, not characters. This tool encodes text as UTF-8, the standard on the web and in most programming languages, so its results match sha256sum, Python's hashlib and Node's crypto for the same UTF-8 string.
Differences usually come from invisible details: a trailing newline (many command-line tools add one when you echo text), Windows line endings (\r\n instead of \n), or a byte order mark at the start of a file. If your hash does not match another tool's, check those first.
Frequently asked questions
How do I check the SHA-256 of a file?
Switch to File, drop the file, and copy the SHA-256 value. To compare with a published checksum, paste it into the Compare box.
Is my file uploaded?
No. The file is read and hashed in your browser, so it can be private and large (up to 1 GB).
Can a hash be reversed?
No. Hash functions are one-way. Short or common inputs can sometimes be guessed, which is why passwords need special slow algorithms.
Why doesn't my hash match the command line?
Usually because of a trailing newline, different line endings or text encoding. This tool hashes exactly the UTF-8 bytes of the text you enter.
Is MD5 still safe?
Not for security. It is still fine for detecting accidental corruption, but use SHA-256 for anything that must resist tampering.
Last updated: November 12, 2026