SHA-256 hashes & file checksums
Live hashes for text, one-click checksums for files — via your browser's own WebCrypto, so nothing leaves your device.
- SHA-256
—- SHA-512
—- SHA-1
—
SHA-1 is shown for legacy checksum files only — it is broken for security purposes. MD5 is omitted for the same reason, twice over.
Checksums exist because you don't trust the network
The canonical scenario: a site publishes an installer and its SHA-256. You download, hash your copy, compare — a match means every byte arrived exactly as published. Which makes uploading that file to a "free hash tool" absurd: the tool would sit in the very position you're defending against. This one runs on WebCrypto inside your browser — the file is read locally, fingerprinted locally, and goes nowhere.
Related text tools
Frequently asked questions
How do I generate a SHA-256 hash?
Type or paste text and the SHA-256, SHA-512 and SHA-1 hashes update live. For a file — say, verifying a downloaded installer — click "Hash a file instead" and pick it; the checksum appears in a second.
How do I verify a file checksum?
Download sites often publish a SHA-256 next to the file. Hash your downloaded copy here and compare: if the hex strings match, the file arrived intact and untampered. This is the main real-world use of checksums.
Why is there no MD5?
MD5 has been cryptographically broken for two decades — collisions can be manufactured at will, so a matching MD5 proves little. SHA-1 is included only because legacy checksum files still use it, with the same caveat.
Is hashing the same as encryption?
No. A hash is a one-way fingerprint — you cannot get the input back from it, and that is the point. Encryption is reversible with a key. Never "encrypt" a password by hashing it in a browser tool.
Does the file I hash get uploaded?
No — hashing runs in your browser via the WebCrypto API built into it. That matters here specifically: the whole reason you verify a checksum is distrust of the network, so re-uploading the file would defeat the purpose.