Checksum calculator: SHA-256, SHA-1, MD5 and CRC32
Drop a file to compute all four checksums at once, or paste the hash a download page gave you and have it checked automatically. The file is read in this browser tab and never uploaded, so it is safe to hash confidential material.
📥
Drop a file to compute its checksums
or click to browse · paste from clipboard · drop a whole folder
Any file, any format, up to 2GB. All four digests are computed in a single streaming pass, so a large file is read from disk only once.
Which checksum should you use?
All four algorithms here answer the same question — "did these bytes change?" — but they are not interchangeable.
Algorithm guide
SHA-256 — The default choice. Cryptographically secure, and what almost every Linux distribution, package registry and software vendor publishes today. Use this unless you have a reason not to.
SHA-1 — Broken for security since 2017: a chosen-prefix collision is achievable by a well-funded attacker. Still fine for detecting accidental corruption, and still used by Git for object addressing. Do not rely on it to prove a file has not been tampered with.
MD5 — Thoroughly broken for security; collisions can be generated on a laptop in seconds. It remains widespread because it is fast and many older download pages still publish it. Treat a matching MD5 as evidence against corruption, never as proof of authenticity.
CRC32 — Not a cryptographic hash at all. It is a 32-bit error-detecting code designed to catch transmission noise, and it is trivial to forge. ZIP archives store one per entry, which is why it appears here.
The practical rule: if you are checking that a download completed correctly, any of them works.
If you are checking that a download was not modified by someone, only SHA-256 is meaningful.
Verifying a download
The usual reason to compute a checksum is to compare it against one published by whoever distributed the file.
Copy the hash from the download page. It usually looks like a 64-character string of hex digits for SHA-256, or 32 characters for MD5.
Drop the downloaded file above.
Paste the hash into the Verify against a known hash box in the results.
The algorithm is detected from the length of what you paste, so you do not need to say which one it is.
You can paste the raw hash, or the whole line from a SHA256SUMS file including the filename —
the trailing filename is ignored. Comparison is case-insensitive.
A match means the bytes you have are byte-for-byte identical to the bytes whoever published that hash had.
A mismatch means something differs — an incomplete download, a different version, or in the worst case a
modified file. It does not tell you which.
Worth being clear about: verifying a checksum only proves the file matches the hash you
were given. If an attacker controls the page showing you both the download and the hash, they can change
both. Checksums protect against corrupted mirrors and interrupted downloads, not against a compromised source.
Getting the same result on the command line
Every value here matches what your operating system reports. Useful if you want to check this tool against something you already trust.
Equivalent commands
Linux sha256sum file.iso md5sum file.iso
macOS shasum -a 256 file.iso md5 file.iso
Windows (PowerShell) Get-FileHash file.iso -Algorithm SHA256
Windows (cmd) certutil -hashfile file.iso SHA256
Windows tools print hashes in uppercase and PowerShell omits spaces; this page shows lowercase for
SHA and MD5 to match the Unix convention. Comparisons ignore case either way, so pasting output from
any of them works.
🔒 Why this is safe for confidential files
Nothing is uploaded The file is read directly from your disk by JavaScript in this tab. No network request carries its contents.
No server to trust There is no backend. Even if we wanted your files, there is nowhere for them to go.
Works with the network off Load the page once, disconnect, and every tool still works. That is the strongest proof that nothing is being sent.
Nothing is retained Close the tab and the file is gone from memory. No history, no accounts, no storage.
Checksum questions
Yes. The file is read by JavaScript running in your own browser tab and the bytes never leave your machine. You can verify this by disconnecting from the internet after the page loads — hashing still works, which would be impossible if it depended on a server.
Up to about 2GB, which is the practical ceiling for file handling in browsers. The file is read in 4MB chunks and fed through the digest incrementally, so memory use stays flat regardless of file size. A 120MB file hashes in roughly five seconds on a typical laptop.
The most common cause is an incomplete or resumed download. Re-download the file and try again. Other causes: you hashed a different version than the one the hash was published for, the page lists hashes for several files and you compared against the wrong one, or the file was decompressed after download and you are hashing the extracted contents rather than the archive.
For detecting accidental corruption, yes. For security, no. MD5 collisions can be produced in seconds on ordinary hardware, meaning someone can construct two different files with the same MD5. If you are verifying that nobody tampered with a download, use SHA-256. If you are checking that a file copied correctly, MD5 is fine and faster.
CRC32 is 32 bits — eight hex characters — versus 256 bits for SHA-256. It is an error-detecting code, not a hash function, designed to catch the kinds of bit errors that happen on noisy transmission lines. With only about four billion possible values, accidental collisions are genuinely likely across large collections of files.
No. There is no backend and no database. The values exist only in this tab, and disappear when you close it.