File Hash (Checksum)
Drop in any file and get its SHA-1, SHA-256, and SHA-512 digests as lowercase hex, computed in parallel with the browser's built-in Web Crypto API (crypto.subtle.digest). These are the same standardized algorithms used by command-line tools, so the results match sha256sum on Linux, shasum -a 256 on macOS, and Get-FileHash on Windows exactly. The file is read into memory on your device and never uploaded — hashing even works offline once the page has loaded. The classic use case is verifying a download: publishers of ISOs, installers, and firmware list a checksum next to the file, and if your locally computed digest matches, the bytes arrived intact and unmodified. A hash covers content only, so renaming a file doesn't change it, while flipping a single bit produces a completely different digest (the avalanche effect). One caveat: SHA-1 is included for compatibility with older published checksums, but real-world collisions have been demonstrated against it — treat it as a corruption check and rely on SHA-256 or SHA-512 when security matters.
Drag & drop a file here
or click to browseHow to use
- Drag a file onto the drop zone, or click it to open the file picker.
- Wait a moment while all three digests are computed — large files can take a few seconds.
- Copy the hash you need with its Copy button.
- Compare it with the published checksum for the same algorithm; hex case doesn't matter, but every character must match.
- Click Clear to reset and hash another file.
Frequently asked questions
- Is my file uploaded anywhere?
- No. The file is read locally and hashed with the Web Crypto API built into your browser; no bytes leave your device, and the computation works offline once the page has loaded.
- Why is there no MD5 option?
- The Web Crypto API deliberately doesn't expose MD5 because it has been cryptographically broken for years. If a site publishes only an MD5 checksum, treat it purely as an accidental-corruption check, never as proof a file wasn't tampered with.
- Is SHA-1 still safe to use?
- For detecting accidental corruption, yes. For security, no: practical collision attacks (such as the 2017 SHAttered attack) mean an attacker can craft two different files with the same SHA-1. When a publisher offers several checksums, verify SHA-256 or SHA-512.
- How large a file can it hash?
- The whole file is read into memory before hashing, so the limit is your device's available RAM. Files up to a few hundred MB are typically fine; for multi-gigabyte files, especially on mobile, a command-line tool like sha256sum is the better choice.
- The hash doesn't match the published value — what should I do?
- First confirm you're comparing the same algorithm and the entire string (letter case doesn't matter in hex). If it still differs, the file's bytes differ from the original — an incomplete download, a different version, or tampering. Re-download and re-check before opening or installing it.
Guides on this topic
- Why In-Browser Tools Keep Your Data Private How client-side tools work, why running entirely in your browser means your data never leaves your device, and how to verify that claim yourself.
- Why your MP3 tags look different in every player One player shows the old album name, another shows the new one, and the artwork only appears on your phone. The file usually carries two sets of tags, and players disagree about which to believe.
Related tools
File Hash Verifier
Drop a file and paste an expected SHA-1 / 256 / 384 / 512 — see if the actual hash matches. Useful before installing downloaded binaries.
Hash Generator (SHA)
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
HMAC Generator (SHA-1 / 256 / 384 / 512)
Compute HMAC signatures with Web Crypto — sign webhook payloads, verify API requests, hex or base64 output.
Bcrypt Hash & Verify
Generate bcrypt hashes with adjustable cost factor, or verify an existing hash against a password — runs entirely in your browser.
CSP Hash Generator
Compute the sha256 / sha384 / sha512 base64 hash an inline <script> or <style> block needs to be whitelisted by a Content-Security-Policy.
Bencode / .torrent Inspector
Drop any bencoded file (.torrent or raw bencode) and inspect its tree, info hash (SHA-1), trackers, file list, piece length, and creation metadata — all parsed locally in your browser.