Contact

Tools  /  Security  /  Checksum Calculator

SECURITY

Checksum Calculator

Auto-detects and verifies against any real checksum format -- SRI, npm/package-lock integrity, pip --hash, Docker digests, sha256sum lines -- and generates a file's checksum in every one of those formats at once.

More Security tools

Password Entropy Calculator Hash Generator Password Generator JWT Decoder & Generator HMAC Generator Hash Identifier

What this tool does

Most "checksum calculator" tools assume you already know which of several incompatible formats you're looking at. This one doesn't -- paste a checksum string from an SRI integrity attribute, an npm package-lock.json, a pip --hash requirements line, a Docker image digest, or a classic sha256sum output line, and it auto-detects the format and algorithm before verifying it against a file you upload. The Generate tab does the reverse -- upload a file once, get its checksum formatted correctly for every one of those contexts at once. This is a focused, format-literacy companion to this site's File Hash Calculator (which covers six algorithms side by side on one format) and its single-algorithm SHA-256 and SHA-512 siblings.

Why there are so many checksum formats

They all do the same underlying job -- prove a file's bytes match what the publisher intended -- but each ecosystem invented its own wire format independently. SRI (Subresource Integrity), a W3C standard, is algorithm-base64hash, used in an HTML tag's integrity attribute to let a browser refuse a tampered CDN-hosted script. npm adopted the same SRI format directly for its lockfile's integrity field, so an SRI string and a modern npm integrity string are actually interchangeable. pip's hash-checking mode uses algorithm:hexhash in requirements.txt. Docker/OCI image digests use the identical algorithm:hexhash shape for a different purpose -- content-addressing an image layer. And the classic sha256sum/shasum output is just hexhash filename, the format most people think of first.

Base64 vs hex

The one detail that trips people up most: SRI and npm integrity strings encode the raw digest bytes as Base64, while pip, Docker, and sha256sum all use hex. The same underlying hash looks completely different as text depending on which encoding its ecosystem picked -- this tool converts between them automatically rather than making you do it by hand.

Privacy

Everything runs entirely in your browser via the native Web Crypto API. Nothing you paste or upload here is sent anywhere.

FAQ

Frequently asked questions

What formats does this tool recognize?
Subresource Integrity (SRI) strings, npm/package-lock integrity strings (the same SRI format), pip --hash requirements lines, Docker/OCI image digests, classic sha256sum/shasum output lines, and raw hex digests -- auto-detected from the pasted text.
Are npm integrity strings really the same as SRI?
Yes -- modern npm lockfiles (v2 and later) use the standard W3C Subresource Integrity format directly for the integrity field. An SRI string copied from an HTML integrity attribute and an npm integrity string are the same format.
Why do SRI/npm hashes look so different from Docker/pip hashes?
Encoding, not algorithm. SRI and npm encode the raw digest bytes as Base64; pip, Docker, and sha256sum encode the same kind of digest as hex. The underlying hash algorithm (SHA-256, SHA-384, SHA-512) can be identical -- only the text representation differs.
Can I generate a checksum in all these formats from one file?
Yes -- the Generate tab hashes an uploaded file once and outputs it pre-formatted as an SRI/npm integrity string (SHA-256/384/512), a pip --hash line, a Docker-style digest, and a sha256sum-compatible line.
How is this different from the File Hash Calculator?
The File Hash Calculator covers six algorithms side by side in one consistent hex/Base64 format. This tool is about format literacy across ecosystems -- recognizing and converting between the different wire formats SRI, npm, pip, Docker, and sha256sum each use for essentially the same kind of hash.
Is anything I paste or upload here sent anywhere?
No. Every parse, hash, and comparison runs entirely in your browser using the native Web Crypto API -- this tool has no server component.
Theme Accent