File Hash Generator — MD5, SHA-256 & SHA-512
Hash files and text with MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — and check a download against its published checksum file.
Runs in your browser — nothing is uploaded. Verify it
About the File Hash Generator — MD5, SHA-256 & SHA-512
A file hash generator that runs entirely in your browser: drop any file, of any size, and read its MD5, SHA-1, SHA-256, SHA-384 or SHA-512 digest — or paste a published checksum file and have each download checked against the line that names it.
A checksum is the only practical way to know that a download arrived intact, and the file you are checking is usually the one you least want to hand to somebody else's server.
How to use the File Hash Generator — MD5, SHA-256 & SHA-512
- Drop one or more files anywhere on the page, or type text into the box at the top. Files are read in 4 MiB slices, so a multi-gigabyte ISO hashes with flat memory and a live progress bar.
- Pick which digests you want, or paste the checksums the publisher provided. The tool computes whatever algorithm that block names, then matches each file to the line that names it.
- Read the verdict on each row — the published digest, the one this file produced, and whether they agree — and copy or download the results.
Frequently asked questions
How do I check a SHA-256 checksum?
Open the checksum file the publisher provides — usually a file called SHA256SUMS, checksums.txt or something ending in .sha256 — and paste its contents into the "Expected checksums" box. Then drop the file you downloaded. Each row shows the published digest, the digest this file produced, and a verdict. The match is made by filename, so you do not have to copy the right line out of a list of forty.
Are my files uploaded to a server?
No. Every digest is computed in your browser with JavaScript, and the file is read in 4 MiB slices straight from disk. Nothing is sent anywhere — you can disconnect from the network after the page has loaded and the tool still works. That matters here more than on most tools, because the two things people hash are files they just downloaded and passwords they are about to store.
Which should I use — MD5, SHA-1 or SHA-256?
SHA-256, for anything new. MD5 and SHA-1 are both broken for security purposes: practical collisions have existed since 2004 and 2017 respectively, so an attacker can craft two different files with the same digest. They remain fine for spotting a corrupted download, which is why the tool still computes them — a vendor page that publishes only an MD5 leaves you no choice. Never use a plain MD5 or SHA-256 to store a password; that needs bcrypt, scrypt or Argon2, which are deliberately slow.
Can I hash a file larger than my computer's memory?
Yes. This is the reason the tool does not use the browser's built-in crypto API: that API needs the whole file in memory at once, so a 6 GB ISO would fail. The digests here are computed incrementally, reading 4 MiB at a time, so peak memory stays flat no matter how large the file is. A 1 GB file takes roughly twenty seconds and a 4 GB file a couple of minutes, and the progress bar moves throughout.
The checksum does not match. What does that mean?
Read the verdict carefully, because there are three different answers and only one of them is bad news. "Does NOT match" means the digest the publisher listed for this filename is different from the one your file produced — the file is not the one that checksum describes, so do not run it. "Not listed" means the block you pasted does not mention this filename at all, which is common when a release publishes checksums for one artefact and you downloaded another. "Not computed" means the block expects an algorithm you have not selected; choose it and the row will decide. If a digest looks truncated, check the line count: a hash copied off a web page is often a character or two short, and the tool names that line rather than ignoring it.
Can I paste a checksum file with many lines in it?
That is what the box is for. Both common formats are read: the coreutils style that sha256sum writes (the digest, two spaces, then the filename, or an asterisk before the filename for binary mode) and the BSD style that macOS shasum prints (SHA256 (filename) = digest). Comments starting with # are skipped, filenames containing spaces are kept whole, and a digest on its own with no filename is applied to every file. If a line is not a valid checksum — usually because it was copied short — the tool says which line and why instead of silently finding nothing.
Why is the SHA-256 of an empty file always the same?
Because a hash function has no special case for empty input. SHA-256 of zero bytes is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, every time, on every machine. That is a useful sanity check on any hash tool: if a tool reports something else for an empty file, or reports an error, it is not computing SHA-256. This tool computes it correctly and shows it, and the same digest is the published test vector in FIPS 180-4.
Guides
- File Hash Generator: Verify a SHA-256 Checksum
How to verify a downloaded file against the SHA256SUMS file its publisher ships, without copying one hash out of forty by hand.
- How to Format, Validate, and Minify JSON
Learn how to format, validate, and minify JSON online. A practical guide to working with JSON safely in your browser.