Hash Calculator
Compute MD5, SHA-1, SHA-256, SHA-512, SHA-3 and CRC32 hashes of any text or file in one go. Paste the checksum from a download page and the tool tells you whether the file matches. Text and files never leave your browser; nothing is uploaded to a server.
Hashes appear here as you type.
File hash and checksum check
Uses the algorithms and the expected hash selected above.
What is a hash?
A hash function turns data of any length into a fixed-length value. The same input always gives the same output, changing a single character changes the output completely, and the original data cannot be recovered from the hash (it is one-way). That makes hashes ideal as checksums for verifying that a file was not altered or corrupted in transit, for comparing files, and as a fingerprint of data. Unlike encryption there is no key and nothing to decrypt.
For example, the SHA-256 of hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, while
Hello with a capital H gives a completely different value. This tool hashes text as UTF-8 bytes, so it matches Python’s
hashlib.sha256(s.encode()).hexdigest() and the Linux sha256sum command.
Which algorithm should you use?
| Algorithm | Output | Security | Typical use |
|---|---|---|---|
| CRC32 | 32 bits (8 hex) | Not cryptographic | Error detection inside ZIP and PNG files, quick transfer checks |
| MD5 | 128 bits (32 hex) | Collisions found (2004) | Legacy checksums, finding duplicate files. Not for security |
| SHA-1 | 160 bits (40 hex) | Collisions found (2017) | Older Git commit IDs and certificates. Avoid for new uses |
| SHA-256 | 256 bits (64 hex) | Secure | The default choice. Download checksums, TLS certificates, Bitcoin, code signing |
| SHA-224 · SHA-384 | 224 · 384 bits | Secure | Truncated variants of SHA-256 and SHA-512, used when a standard requires them |
| SHA-512 | 512 bits (128 hex) | Secure | Often faster than SHA-256 on 64-bit CPUs. Linux distribution ISO checksums |
| SHA3-256 · SHA3-512 | 256 · 512 bits | Secure | Newest standard (Keccak) with a different design from SHA-2; a hedge if SHA-2 is ever broken; used in Ethereum-style systems |
There is no standard algorithm called “SHA-1024”. SHA-2 tops out at 512 bits; for longer output use SHA3-512 or an extendable-output function such as SHAKE. MD5 and SHA-1 are proven to allow two different files with the same hash, so for anything involving tampering use SHA-256 or stronger. For detecting accidental corruption during a download, MD5 is still perfectly adequate.
How to verify a downloaded file
Official download pages usually list a SHA-256 checksum next to the installer. Pick the downloaded file above and paste that checksum into “Expected hash”;
the tool shows whether they match. A sha256sum line with a file name after the hash, or a sha256: prefix, is accepted as is. To check from the command line:
| Platform | Command |
|---|---|
| Windows (PowerShell) | Get-FileHash file.iso -Algorithm SHA256 |
| Windows (Command Prompt) | certutil -hashfile file.iso SHA256 |
| macOS | shasum -a 256 file.iso |
| Linux | sha256sum file.iso (md5sum for MD5) |
| Python | hashlib.sha256(open("file.iso","rb").read()).hexdigest() |
A matching checksum proves the file did not change during the download. To also rule out a tampered download page, verify the publisher’s GPG signature as well.
Why not use this for passwords
MD5 and SHA-256 are designed to be fast, so an attacker with a leaked hash can try billions of common passwords per second. Passwords must be stored with a deliberately slow function such as bcrypt, scrypt or Argon2 plus a random salt. This tool is for verifying files and comparing data; a plain hash is not “encryption” for a password. Nothing you type here is sent anywhere, but there is also no reason to type a real password.
Frequently asked questions
Are my text and files uploaded?
No. Hashing runs entirely in your browser (WebAssembly) and nothing is sent to or stored on a server. Multi-gigabyte files are read 4 MB at a time rather than loaded into memory.
Another site gives a different hash for the same text.
Almost always a trailing newline, extra spaces or a different character encoding. echo hello | sha256sum hashes hello\n including the newline, which differs from
this tool’s hello (use echo -n). Non-ASCII text is hashed as UTF-8.
I did not select the algorithm of my expected hash, yet it was compared.
The tool guesses the algorithm from the length of the pasted hash (32 hex = MD5, 40 = SHA-1, 64 = SHA-256 or SHA3-256, 128 = SHA-512 or SHA3-512 …) and computes it automatically. Case does not matter.
Does it do HMAC or password hashes like bcrypt?
No, only keyless hashes. If you need to inspect a hash inside a JSON response, tidy it first with the JSON formatter; to encode binary data rather than hash it, use the Base64 encoder.
Sources
- SHA-1 and SHA-2 (SHA-224/256/384/512) specification: NIST FIPS 180-4
- SHA-3 specification: NIST FIPS 202
- MD5 specification: RFC 1321
- SHA-1 collision attack (SHAttered, 2017): Google Security Blog
- Hashing library used in the browser: hash-wasm (GitHub, MIT)
Found this useful? Share it
Only the page link is shared. Your inputs and files are never included.