How do I check the SHA-256 checksum of a file?

Choose Files, drop the file and keep SHA-256 selected. Paste the published checksum into the expected checksum field and the digest is highlighted when it matches.

Is MD5 still safe to use?

Not for security. MD5 and SHA-1 collisions can be produced deliberately, so they cannot protect against tampering. They remain acceptable for detecting accidental corruption or matching an old checksum.

Can a hash be reversed or decrypted?

No. A hash is one-way. Sites that claim to reverse MD5 only look the digest up in tables of hashes of common inputs, which is why short or common inputs are not protected by hashing.

Should I use SHA-256 to store passwords?

No. Use a dedicated password-hashing function such as Argon2id, bcrypt or scrypt. They are deliberately slow and salted, which makes cracking leaked passwords far harder.

Can I hash very large files?

Yes. Files are read a few megabytes at a time inside your browser, so multi-gigabyte files can be hashed with only a small amount of memory. Speed depends on your disk and processor.

Why do I get a different hash for the same text?

Invisible differences change the hash: a trailing newline, Windows (CRLF) versus Unix (LF) line endings, or a different text encoding. This tool hashes text as UTF-8 exactly as it appears in the box.

What is the difference between a hash and an HMAC?

A hash depends only on the data, so anyone can compute it. An HMAC also depends on a secret key, so only someone with the key can produce or check it. Webhooks and API signatures use HMACs.

Are my files uploaded?

No. Hashing runs in a WebAssembly worker in your browser. Files and text never leave your device.

Hash Generator & Checksum Calculator

MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 and CRC32 for text and files. Всё выполняется локально — ничего не отправляется на сервер.

Вход: Text · files of any size
Выход: Hex digests · checksum match

Text

43 B · UTF-8

Digests

hashing…

MD5…
SHA-1…
SHA-256…
SHA-512…

Hashes and checksums for text and files, computed on your device

This hash generator computes MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE3 and CRC32 digests of text as you type, or of files of any size, all at once. Paste the checksum a download page publishes and it tells you whether your file matches. Files are read in chunks inside your browser, so even multi-gigabyte disk images are hashed without being uploaded anywhere.

How to generate a hash or verify a checksum

Choose Text to hash what you type, or Files to hash one or more files.
Pick the algorithms you need. MD5, SHA-1, SHA-256 and SHA-512 are selected to start with.
For a file, drop it on the page. A progress bar shows each file being read; the digests appear when it finishes.
To verify a download, paste the published checksum into the expected checksum field. The matching algorithm and file are highlighted in green.
Copy any digest, switch between lower-case hex, upper-case hex and Base64, or export a .sha256-style checksum file for all your files.

What a hash is

A cryptographic hash function turns any input — a word, a document, a 4 GB ISO — into a short fixed-length fingerprint. The same input always gives the same digest, and changing a single bit of the input changes the digest completely. A good hash is also one-way: you cannot work back from the digest to the input, and you cannot find two inputs with the same digest.

That is what makes hashes useful for checking integrity. If the SHA-256 of the file you downloaded equals the SHA-256 the publisher lists, the file is byte-for-byte what they released, not a truncated download or a tampered copy. Hashes also identify content in Git, deduplicate files in backups and sign data together with a key.

Which algorithm should I use?

SHA-256: The default choice today: secure, universally supported, and what most download pages, package managers and certificates use.
SHA-384 / SHA-512: Longer members of the SHA-2 family. SHA-512 is often faster than SHA-256 on 64-bit machines. SHA-384 is common in Subresource Integrity values.
SHA3-256 / SHA3-512: A different design (Keccak) standardised in 2015, as a backup should SHA-2 ever be weakened. Secure, but less widely used.
BLAKE3: A modern, very fast secure hash, popular for file checksums and content addressing in newer tools.
MD5 and SHA-1: Broken for security: researchers can create different files with the same digest. Still fine for spotting accidental corruption and for matching legacy checksums, but never rely on them against an attacker.
CRC32: A 32-bit error-detecting code, not a cryptographic hash. Used inside ZIP, PNG and Ethernet to catch accidental damage; trivial to forge on purpose.

Verifying a downloaded file

Download pages for operating systems and software often publish a checksum next to the file, or a SHA256SUMS file. Drop your download here, paste the published value into the expected checksum field, and the matching digest lights up. The comparison ignores letter case and surrounding spaces, and accepts a whole sha256sum line or a sha384-… integrity value as it is.

A match proves the file is intact, but only proves it is authentic if you got the checksum from a source you trust — ideally over HTTPS from the publisher's own site, or with a signature. An attacker who can replace the file on a mirror may be able to replace the checksum beside it too.

The exported checksum file uses the standard <digest> <filename> layout, so sha256sum -c checksums.sha256 on Linux and macOS can check it later.

Hashing passwords? Use a password hash instead

General-purpose hashes like MD5, SHA-1 and even SHA-256 are designed to be fast, which is exactly wrong for passwords: an attacker with a GPU can try billions of guesses per second against a leaked list. Store passwords with a slow, salted password-hashing function such as Argon2id, bcrypt or scrypt, through your framework's built-in support. To create strong passwords or keys in the first place, use the password generator.

For authenticating a message with a shared secret, such as a webhook signature, use an HMAC rather than hashing the secret and message together yourself. The HMAC tab computes HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512 with your browser's Web Crypto API.

Часто задаваемые вопросы

How do I check the SHA-256 checksum of a file?: Choose Files, drop the file and keep SHA-256 selected. Paste the published checksum into the expected checksum field and the digest is highlighted when it matches.
Is MD5 still safe to use?: Not for security. MD5 and SHA-1 collisions can be produced deliberately, so they cannot protect against tampering. They remain acceptable for detecting accidental corruption or matching an old checksum.
Can a hash be reversed or decrypted?: No. A hash is one-way. Sites that claim to reverse MD5 only look the digest up in tables of hashes of common inputs, which is why short or common inputs are not protected by hashing.
Should I use SHA-256 to store passwords?: No. Use a dedicated password-hashing function such as Argon2id, bcrypt or scrypt. They are deliberately slow and salted, which makes cracking leaked passwords far harder.
Can I hash very large files?: Yes. Files are read a few megabytes at a time inside your browser, so multi-gigabyte files can be hashed with only a small amount of memory. Speed depends on your disk and processor.
Why do I get a different hash for the same text?: Invisible differences change the hash: a trailing newline, Windows (CRLF) versus Unix (LF) line endings, or a different text encoding. This tool hashes text as UTF-8 exactly as it appears in the box.
What is the difference between a hash and an HMAC?: A hash depends only on the data, so anyone can compute it. An HMAC also depends on a secret key, so only someone with the key can produce or check it. Webhooks and API signatures use HMACs.
Are my files uploaded?: No. Hashing runs in a WebAssembly worker in your browser. Files and text never leave your device.