What is a hash?
A hash is a calculation that condenses data of any size into a string of fixed length. SHA-256, for example, always produces a 64-character hexadecimal string, whether the input is a single letter or a 10GB video file. The same input always produces the same hash, and changing even a single bit of the input produces a completely different result. That makes hashes a fast way to check whether two pieces of data are really identical.
How to use this tool
Paste text or drop a file, and the hash for each algorithm you’ve selected is calculated. You can turn on several algorithms at once, and view the result as hexadecimal (lowercase or uppercase) or Base64. Large files are read and hashed in small chunks instead of being loaded into memory all at once, so you’ll see a progress bar and can cancel at any time. If you already have a hash value from the file’s publisher, paste it into the compare box to see whether it matches.
Checking file integrity with a hash
Download pages for software or disk images often list a hash next to the file, like “SHA-256: 3a7bd3e2…”. If the value you compute here with the same algorithm matches that string, the file wasn’t corrupted or swapped for a different one during transfer. If the values don’t match, download the file again. This check confirms the file matches what the publisher listed — it doesn’t by itself prove the publisher’s listed value hasn’t been tampered with.
MD5 and SHA-1: still useful, no longer secure
MD5 (128 bits, 32 hex characters) and SHA-1 (160 bits, 40 hex characters) are fast to compute and have been around for a long time, so they’re still commonly used for checksums. But both have known “collisions” — cases where two different inputs produce the same hash. A real MD5 collision was demonstrated in 2004, and a real SHA-1 collision was published in the 2017 “SHAttered” research. That’s why digital signatures and certificates — situations where someone might deliberately try to forge a match — now use SHA-256, SHA-384, or SHA-512 instead. Passwords are a different case: general-purpose hashes like MD5, SHA-1, SHA-2 and SHA-3 are all too fast to be suitable for storing passwords. Use a deliberately slow password-hashing function such as Argon2id, scrypt or bcrypt instead. For simply confirming a file wasn’t corrupted in transit, MD5 and SHA-1 are still practical.
Privacy: everything runs in your browser
This tool runs a WebAssembly hashing library directly inside your browser. Neither your text nor your file ever leaves this page or gets stored on a server. It even keeps working without an internet connection once the page has loaded.