How do I verify a downloaded file?

Find the checksum on the download page (usually labelled SHA256, SHA-256 or MD5, sometimes in a file such as SHA256SUMS). Switch to File, drop in the downloaded file and paste the checksum into Compare with expected value. A green Match means the file is identical to the official one; a red Mismatch means the download is incomplete, was altered by a proxy or file host, or is the wrong version, so download it again. A whole "checksum filename" line can be pasted as is.

Why does my hash of the same text differ from someone else's?

A digest changes completely if a single byte differs. In testing, SHA-256 of abc is ba7816bf…f20015ad; abc with a trailing newline (which Linux echo adds by default) is edeaaff3…0efd18cb; with a Windows CR LF it is 552bab68…85fdb025. Non-ASCII text also depends on encoding: the MD5 of 中文 is a7bac223…7c4a07 in UTF-8 but bcce1097…e12895 in GBK. This tool hashes UTF-8 with no added newline, so use echo -n or printf when comparing on the command line.

How long is each hash?

The length is fixed regardless of input size, which tells you what kind of value you were given: MD5 is 32 hex digits (128 bits), SHA-1 is 40, SHA-256 is 64, SHA-384 is 96 and SHA-512 is 128. Empty input also has a fixed digest: MD5 d41d8cd98f00b204e9800998ecf8427e and SHA-256 e3b0c442…7852b855. If you see these, the file was probably empty or not read.

Are MD5 and SHA-1 still OK to use?

They are fine for checking that a file was not corrupted or truncated, and many download sites still publish only MD5. But two different files with the same digest can now be crafted on purpose: a practical MD5 collision method was published by Wang Xiaoyun's team in 2004, and Google and CWI published colliding PDFs for SHA-1 in 2017. To guard against deliberate tampering, for signatures, or anywhere security matters, use SHA-256 or stronger; for passwords use a salted password-hashing algorithm, not a plain digest.

How long do large files take?

Measured on an Apple silicon computer in Chrome: for a 1 GB file, reading into memory took about 0.6 s, SHA-256 about 0.9 s and all four SHA digests about 3 s, with MD5 on top. Above 1 GB the tool switches to chunked hashing of all five algorithms in one pass; a 1.19 GB file took 13.9 s, about 90 MB/s. Individually, MD5 runs at about 430 MB/s, SHA-256 about 310 MB/s and SHA-512 about 450 MB/s. Newer computers are faster, phones slower.

Does it match command-line tools?

Yes, the algorithms are standard. On Windows use certutil -hashfile file SHA256 or PowerShell Get-FileHash; on macOS shasum -a 256 file or md5 file; on Linux sha256sum or md5sum. Older certutil prints spaces between bytes and PowerShell prints uppercase; both can be pasted into the comparison box as is.

What about many files at once, or CRC32?

Use the site's File Checksum tool: drop in several files to compute MD5, SHA-1, SHA-256 and CRC32 in a batch, check them against a pasted SHA256SUMS list and export a list of your own. This page is for text and single files and adds SHA-384 and SHA-512.

Are my files or data uploaded?

No. Everything runs locally in your browser with no network upload, and is discarded when you close the page.

Do I need to sign up or pay?

No. The site is completely free, needs no account and has no usage limits.

#️⃣

#️⃣Online Hash Calculator - MD5, SHA-256 & More

Compute digests (hashes) of text or any file, getting MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, each with its own copy button. After downloading an OS image or installer, paste the published checksum into Compare with expected value: the tool works out the algorithm from the length, turns the matching row green or the mismatching row red, and accepts a trailing file name, uppercase or colon-separated forms. Files up to 1 GB are read into memory and hashed with the browser's native Web Crypto, which in testing did all four SHA digests of 1 GB in about 3 seconds; larger files are read in 16 MB chunks with a progress readout, so memory use stays at one chunk and file size is not a limit. Text is hashed as UTF-8, matching Linux and macOS command-line tools. Everything runs locally and files are never uploaded.

Loading tool...

How to use Hash / Checksum

1Choose Text or File
2Type text, or drop the file to check; large files show progress
3To verify a download, paste the published MD5 or SHA value into Compare with expected value and look for a green Match or red Mismatch
4Click Copy on the row you need

FAQ

How do I verify a downloaded file?: Find the checksum on the download page (usually labelled SHA256, SHA-256 or MD5, sometimes in a file such as SHA256SUMS). Switch to File, drop in the downloaded file and paste the checksum into Compare with expected value. A green Match means the file is identical to the official one; a red Mismatch means the download is incomplete, was altered by a proxy or file host, or is the wrong version, so download it again. A whole "checksum filename" line can be pasted as is.
Why does my hash of the same text differ from someone else's?: A digest changes completely if a single byte differs. In testing, SHA-256 of abc is ba7816bf…f20015ad; abc with a trailing newline (which Linux echo adds by default) is edeaaff3…0efd18cb; with a Windows CR LF it is 552bab68…85fdb025. Non-ASCII text also depends on encoding: the MD5 of 中文 is a7bac223…7c4a07 in UTF-8 but bcce1097…e12895 in GBK. This tool hashes UTF-8 with no added newline, so use echo -n or printf when comparing on the command line.
How long is each hash?: The length is fixed regardless of input size, which tells you what kind of value you were given: MD5 is 32 hex digits (128 bits), SHA-1 is 40, SHA-256 is 64, SHA-384 is 96 and SHA-512 is 128. Empty input also has a fixed digest: MD5 d41d8cd98f00b204e9800998ecf8427e and SHA-256 e3b0c442…7852b855. If you see these, the file was probably empty or not read.
Are MD5 and SHA-1 still OK to use?: They are fine for checking that a file was not corrupted or truncated, and many download sites still publish only MD5. But two different files with the same digest can now be crafted on purpose: a practical MD5 collision method was published by Wang Xiaoyun's team in 2004, and Google and CWI published colliding PDFs for SHA-1 in 2017. To guard against deliberate tampering, for signatures, or anywhere security matters, use SHA-256 or stronger; for passwords use a salted password-hashing algorithm, not a plain digest.
How long do large files take?: Measured on an Apple silicon computer in Chrome: for a 1 GB file, reading into memory took about 0.6 s, SHA-256 about 0.9 s and all four SHA digests about 3 s, with MD5 on top. Above 1 GB the tool switches to chunked hashing of all five algorithms in one pass; a 1.19 GB file took 13.9 s, about 90 MB/s. Individually, MD5 runs at about 430 MB/s, SHA-256 about 310 MB/s and SHA-512 about 450 MB/s. Newer computers are faster, phones slower.
Does it match command-line tools?: Yes, the algorithms are standard. On Windows use certutil -hashfile file SHA256 or PowerShell Get-FileHash; on macOS shasum -a 256 file or md5 file; on Linux sha256sum or md5sum. Older certutil prints spaces between bytes and PowerShell prints uppercase; both can be pasted into the comparison box as is.
What about many files at once, or CRC32?: Use the site's File Checksum tool: drop in several files to compute MD5, SHA-1, SHA-256 and CRC32 in a batch, check them against a pasted SHA256SUMS list and export a list of your own. This page is for text and single files and adds SHA-384 and SHA-512.
Are my files or data uploaded?: No. Everything runs locally in your browser with no network upload, and is discarded when you close the page.
Do I need to sign up or pay?: No. The site is completely free, needs no account and has no usage limits.

Features

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 in one pass
Automatic comparison with a pasted value; the algorithm is detected by length, and file names, uppercase and colons are accepted
Native Web Crypto for files up to 1 GB, chunked hashing beyond that with no memory limit
Progress for large files and a clear message if a file cannot be read
Text hashed as UTF-8, matching sha256sum, shasum, certutil and similar tools
Files and text are hashed locally and never uploaded

Related tools

View all 93 Developer Tools →