Skip to content
AZ Tools

File Hash (Checksum)

Compute SHA-1, SHA-256, and SHA-512 checksums of any file.

Drag & drop a file here

or click to browse

How to use

  1. Drag a file onto the drop zone, or click it to open the file picker.
  2. Wait a moment while all three digests are computed — large files can take a few seconds.
  3. Copy the hash you need with its Copy button.
  4. Compare it with the published checksum for the same algorithm; hex case doesn't matter, but every character must match.
  5. Click Clear to reset and hash another file.

About this tool

Show

Drop in any file and get its SHA-1, SHA-256, and SHA-512 digests as lowercase hex, computed in parallel with the browser's built-in Web Crypto API (crypto.subtle.digest). These are the same standardized algorithms used by command-line tools, so the results match sha256sum on Linux, shasum -a 256 on macOS, and Get-FileHash on Windows exactly. The file is read into memory on your device and never uploaded — hashing even works offline once the page has loaded.

The classic use case is verifying a download: publishers of ISOs, installers, and firmware list a checksum next to the file, and if your locally computed digest matches, the bytes arrived intact and unmodified. A hash covers content only, so renaming a file doesn't change it, while flipping a single bit produces a completely different digest (the avalanche effect). One caveat: SHA-1 is included for compatibility with older published checksums, but real-world collisions have been demonstrated against it — treat it as a corruption check and rely on SHA-256 or SHA-512 when security matters.

Frequently asked questions

Is my file uploaded anywhere?

No. The file is read locally and hashed with the Web Crypto API built into your browser; no bytes leave your device, and the computation works offline once the page has loaded.

Why is there no MD5 option?

The Web Crypto API deliberately doesn't expose MD5 because it has been cryptographically broken for years. If a site publishes only an MD5 checksum, treat it purely as an accidental-corruption check, never as proof a file wasn't tampered with.

Is SHA-1 still safe to use?

For detecting accidental corruption, yes. For security, no: practical collision attacks (such as the 2017 SHAttered attack) mean an attacker can craft two different files with the same SHA-1. When a publisher offers several checksums, verify SHA-256 or SHA-512.

How large a file can it hash?

The whole file is read into memory before hashing, so the limit is your device's available RAM. Files up to a few hundred MB are typically fine; for multi-gigabyte files, especially on mobile, a command-line tool like sha256sum is the better choice.

The hash doesn't match the published value — what should I do?

First confirm you're comparing the same algorithm and the entire string (letter case doesn't matter in hex). If it still differs, the file's bytes differ from the original — an incomplete download, a different version, or tampering. Re-download and re-check before opening or installing it.

Guides on this topic

Related tools

File Hash Verifier

Drop a file and paste an expected SHA-1 / 256 / 384 / 512 — see if the actual hash matches. Useful before installing downloaded binaries.

File

Hash Generator (SHA)

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.

Developer

DNSSEC Calculator — DS Record & NSEC3 Hash

Turn a DNSKEY into the DS record your registrar wants — key tag and all three digest types — or hash a name the way NSEC3 does.

Network

HMAC Generator (SHA-1 / 256 / 384 / 512)

Compute HMAC signatures with Web Crypto — sign webhook payloads, verify API requests, hex or base64 output.

Developer

Git Object ID (hash-object)

Work out the git object id of a blob, tree, commit or tag in both SHA-1 and SHA-256, with the header git hashes and the loose object path.

Developer

Bcrypt Hash & Verify

Generate bcrypt hashes with adjustable cost factor, or verify an existing hash against a password — runs entirely in your browser.

Developer