Hash calculator
Calculates the hash (checksum) of a file or text with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 and compares it with the value you expect. Nothing is uploaded – only your browser reads the file.
How to use it
- Choose whether you want the hash of a file (such as a downloaded installer) or of some text.
- Pick the file or paste the text. For text you can normalise line endings – the hash depends on every single byte.
- If you are verifying a download, paste the value from the vendor's website into Expected hash. A whole line from a SHA256SUMS file works too.
- Click Calculate hash. The tool shows every hash and, if you entered an expected value, tells you whether it matches.
How it works
A hash (also called a checksum or digest) is a short string calculated from the contents of a file. The same file always produces the same hash, and if a single byte changes, the hash is completely different. The file name and extension make no difference.
When it comes in handy:
- Verifying downloaded software. Vendors publish SHA-256 hashes next to installers and disk images (ISO). If the hash matches, you have exactly the file they released.
- Incident analysis. Compare the hash of a suspicious attachment or executable with the indicators of compromise in a security advisory without ever opening the file.
- Detecting changes. Two files with the same SHA-256 hash have the same contents.
| Algorithm | Length in hex | Use today |
|---|---|---|
| SHA-256 | 64 characters | The standard for verifying files |
| SHA-384, SHA-512 | 96 / 128 characters | Stronger SHA-2 variants |
| SHA-1 | 40 characters | Legacy, older systems and IOCs |
| MD5 | 32 characters | Legacy (RFC 6151), only for spotting corruption and IOCs |
The tool works out from the length of the expected value which algorithm to compare it with.
Without a browser, you can get the hash with Get-FileHash file.iso in Windows PowerShell (SHA-256 by default; choose another with the -Algorithm parameter) or sha256sum file.iso on Linux.
FAQ
Is my file uploaded to a server?
No. A script reads and processes the file right in your browser; nothing is sent or stored. That makes it safe to hash confidential documents too.
What is a file hash good for?
It proves that the file you downloaded is exactly the one the vendor published – that it was not corrupted on the way or swapped by someone else. Analysts also use hashes to look files up in malware databases and in indicators of compromise (IOCs). A hash says nothing about whether a file is safe, only whether it is identical.
The hash doesn't match. What now?
Don't use the file. Check that you are comparing the same algorithm and the same version of the file, then download it again directly from the vendor's official website. If the hash still doesn't match, let the vendor know.
Why are MD5 and SHA-1 marked as legacy?
For both algorithms it is now practical for an attacker to craft two different files with the same hash (a collision). They are still fine for spotting accidental corruption and for looking up known files, but protection against deliberate tampering requires SHA-256 or stronger.
Why does my text give a different hash than another tool?
A hash is calculated from bytes, not from how the text looks. A trailing newline (the echo command adds one), Windows line endings (CRLF) versus Linux ones (LF) and the character encoding all change the result. This tool encodes text as UTF-8 and adds nothing.
How large a file can it handle?
Up to 512 MB. The whole file is loaded into your browser's memory, so the limit may be lower on a less powerful phone. For bigger files, use Get-FileHash in Windows PowerShell or sha256sum on Linux.
Sources
Updated