How do I check a downloaded file's SHA-256 checksum?

Open Hash file, choose the file, and read the SHA-256 value under Hash values. Paste the publisher's checksum into Verify a checksum to see whether it matches.

Which hash algorithms does this tool support?

It computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32. SHA-1 and SHA-256 through SHA-512 use the browser's Web Crypto API; MD5 and CRC32 are built into the tool.

How large a file can I hash?

Files up to 500 MB. Anything larger shows a too-large error, since the whole file is read into browser memory. The file is hashed locally and not sent anywhere.

Why does my hash not match the one on the website?

It reports Does not match when any byte differs, often from an incomplete download or a different algorithm. Check the checksum length: 32 characters is MD5, 40 SHA-1, 64 SHA-256.

Can I use these hashes to store passwords?

No. These are general-purpose checksums and the tool says so. For passwords use bcrypt, Argon2 or scrypt. SHA-1 is also legacy and not recommended for security-sensitive use.

Yes. Every tool is free to use, with no account and no credit card. The work runs on your device rather than on our servers, which is what keeps it free to run.

Does it work on mobile?

Yes. It runs in current mobile browsers on iOS and Android, with nothing to install.

#️⃣

Free Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-512 and CRC32 hashes from text or files. Verify checksums and data integrity.

Runs in your browserNo sign-up, no pop-upsNo login requiredFree forever

Works offline once loaded

Tip: SHA-256 and SHA-512 are cryptographically secure. SHA-1 is legacy and no longer recommended for security-sensitive use. All hashing runs locally in your browser — files and text are never sent anywhere.

Checksums vs. password hashing: These are general-purpose checksums — not a substitute for password hashing (use bcrypt, Argon2, or scrypt for passwords). SHA-1 is also unsuitable for security-sensitive integrity claims.

Common uses

Verify File Integrity with HashGenerate a SHA-256 checksum for a downloaded file and compare it to the publisher's checksum to confirm it's unmodified.
Generate Checksum for Data IntegrityCreate SHA-256 hashes of text or files to detect corruption, verify backups, and audit data pipelines.
Deduplicate Files with HashingIdentify duplicate files by comparing their SHA-256 hashes — identical content produces identical hashes.
Understand Password HashingLearn how cryptographic hashing works by seeing how text changes produce completely different hash outputs.
Generate Hashes for API Request SigningUnderstand HMAC signing by computing the hash of your API payload before sending signed requests.

How It Works

Hash generation runs entirely in your browser using a mix of the Web Crypto API (for SHA-1, SHA-256, SHA-384, and SHA-512) and hand-written implementations of MD5 and CRC32 — because the Web Crypto API intentionally omits both of those older algorithms. No text or file content is ever uploaded anywhere.

1
Input is read into bytes
For text input, the browser's built-in TextEncoder converts the string to a UTF-8 byte array. For files up to 500 MB, the File API's arrayBuffer() method reads the raw binary data directly into memory — the file never leaves your device.
2
Six algorithms run in parallel
SHA-1, SHA-256, SHA-384, and SHA-512 are handed to crypto.subtle.digest(), the browser's native WebCrypto implementation. MD5 is computed by a self-contained RFC 1321 implementation built into the tool (WebCrypto intentionally excludes MD5); for large inputs it yields to the event loop every 4 MB so the tab stays responsive. CRC32 uses a pre-computed 256-entry IEEE 802.3 lookup table for fast byte-by-byte processing.
3
Hex digests are displayed as they finish
Each algorithm's result is written to the UI the moment it resolves — faster algorithms like CRC32 appear almost instantly while SHA-512 over a large file may take a moment longer. All six run concurrently via Promise.all, so total wait time is determined by the slowest algorithm, not their sum.
4
Optional checksum verification
Paste a known checksum into the verify field and the tool compares it against all six computed digests. It auto-identifies which algorithm matches (or should match) by counting the hex characters — 32 chars signals MD5, 40 signals SHA-1, 64 signals SHA-256, and so on — then reports a match, mismatch, or unrecognized length.

Your text and files are processed entirely within your browser — nothing is sent to a server, logged, or stored beyond the current page session.

Related Tools

🔑

File Hash / Checksum

Compute SHA-256, SHA-1, SHA-384, and SHA-512 checksums of any file and verify a download against its published hash. The file is never uploaded.

Try itFiles stay local

📅

ICS Calendar Generator

Open an .ics file to see its events, export them to CSV, or edit them. Or create .ics calendar invites for Apple Calendar, Outlook and Google, with recurrence and reminders. Runs entirely in your browser.

Try it

🔐

chmod Permissions Calculator

Toggle Unix file permissions for owner, group, and other to get the octal value (755), symbolic notation (rwxr-xr-x), and the exact chmod command.