Contact

Tools  /  Security  /  File Hash Calculator

SECURITY

File Hash Calculator

Hash one or many local files with CRC32/MD5/SHA-1/256/384/512, verify against an expected hash, and export a standard checksums file -- all computed entirely in your browser.

More Security tools

Hash Generator Password Generator JWT Decoder & Generator HMAC Generator Hash Identifier Random Token Generator

What this tool does

Computes one or more hash algorithms over one or many local files at once, entirely in your browser -- the files are read with the File API and never leave your machine. Useful for verifying a download matches its published checksum, confirming two files are byte-identical, or generating a checksums manifest for a set of files.

Six algorithms, pick any combination

SHA-256 is checked by default -- the current standard for download verification (what most projects publish alongside a release). SHA-1, SHA-384 and SHA-512 run through the Web Crypto API. MD5 and CRC32 are included from scratch (Web Crypto deliberately doesn't implement either, since both are cryptographically broken) because they're still what a lot of older software and legacy checksum files actually use -- included for compatibility, not recommended for anything security- sensitive.

Verify against an expected hash

Paste a published checksum into the verify field and every computed hash, across every file and every selected algorithm, is checked against it (case-insensitive) -- a match is highlighted directly, which is the actual real-world reason most people reach for a file hash tool: confirming a downloaded file hasn't been corrupted or tampered with.

Multiple files at once

Drag a folder's worth of files onto the drop zone, or select several at once -- each is hashed independently and shown in its own row, with size and last-modified date alongside its hash(es).

Export a checksums file

Download the results as a standard <hash>␣␣<filename> checksums file -- the exact format sha256sum, md5sum and similar tools write and verify (sha256sum -c checksums.txt on the far end), so a manifest generated here is directly usable with those tools.

Why not just read the whole file into memory?

That's exactly what happens here -- the File API's arrayBuffer() reads the full file before hashing, which is how every browser-based hashing tool works, since the Web Crypto API has no incremental/streaming digest mode. This is fast and reliable for essentially any file size a browser can reasonably hold in memory; a very large file (multiple gigabytes) may be slow or hit a browser memory limit, in which case a native command-line tool is the better choice.

What this doesn't replace

A hash confirms integrity (the bytes weren't corrupted or altered) -- it says nothing about authenticity unless the hash itself came from a source you trust through a separate, verified channel. A hash published right next to the file it describes on the same unverified page protects against almost nothing.

Privacy

Every file is read and hashed entirely in your browser. Nothing is uploaded, and no file content or hash is kept anywhere once you leave the page.

FAQ

Frequently asked questions

Which algorithm should I use to verify a download?
Use whatever the publisher actually provided -- usually SHA-256 today. If multiple are published, SHA-256 or higher (SHA-384/512) is preferable to MD5 or SHA-1, which are not collision-resistant and shouldn't be trusted against a deliberate tamperer, only accidental corruption.
Why include MD5 and CRC32 if they're broken?
Both are cryptographically broken for security purposes, but still widely used for plain accidental-corruption checks and in older checksum files you may need to match against -- included for compatibility, with the limitation stated plainly rather than silently omitted.
How does the expected-hash verification work?
Paste a hash into the verify field and it's compared, case-insensitively, against every hash this tool computes across every selected algorithm and every loaded file -- a match is highlighted directly so you don't have to eyeball-compare long hex strings.
Can I hash more than one file at once?
Yes -- drag multiple files onto the drop zone or select several in the file picker; each is hashed independently and shown in its own row.
What format is the exported checksums file?
The standard " " format sha256sum, md5sum and equivalent command-line tools both write and verify, so a file generated here works directly with `sha256sum -c` (or the matching -c flag for whichever algorithm you exported) on the command line.
Does hashing a huge file crash the browser?
The whole file is read into memory before hashing (the Web Crypto API has no streaming digest mode), which works fine for typical file sizes but can be slow or hit a memory limit on a multi-gigabyte file -- a native command-line tool handles those better.
Does a matching hash prove a file is safe?
It proves the bytes match what the hash describes -- nothing more. If the hash itself came from an untrusted source (like the same unverified page as the file), a matching hash offers no protection against a deliberately tampered file and its matching fake hash.
Is any file content uploaded?
No. Every file is read and hashed entirely in your browser using the File API and Web Crypto -- nothing is sent to a server.
Theme Accent