File Hash Generator
Generate SHA-1, SHA-256, and SHA-512 hashes for any file. Runs entirely in your browser — the file is never uploaded.
Drop a file here or click to browse
Any file type · processed locally
Why verify file hashes?
A cryptographic hash is a fixed-length fingerprint of a file's contents. SHA-256 and SHA-512 are part of the SHA-2 family and are widely used to verify file integrity — if even one byte changes, the hash changes completely. Compare the hash you compute here against the checksum published by a software vendor to confirm a download is genuine and wasn't tampered with in transit. SHA-1 is included for legacy compatibility (it is no longer considered secure for cryptographic signing). All hashing runs in your browser using the Web Crypto API — your file is never sent anywhere. For text hashing, try Hash Generator.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Checking a downloaded file against the checksum a publisher printed.
- Confirming two files are identical without comparing them byte by byte.
- Producing a fingerprint to record in an audit trail.
- Verifying a file survived a transfer intact.
- Hashing a file you should not upload to a hosted checksum service.
Frequently Asked Questions
- Which algorithms does it compute?
- SHA-1, SHA-256, SHA-384 and SHA-512, through the browser's own SubtleCrypto. MD5 is deliberately absent from that list — it is broken for any integrity purpose where an attacker is involved, and the Web Crypto API does not implement it at all.
- How does the compare field know which algorithm I pasted?
- From the length of the hex digest. 40 characters is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512 — each is unambiguous. That is what lets you paste a checksum straight off a vendor's download page without also being asked which algorithm produced it.
- Is my file uploaded to be hashed?
- No. It is read into memory and hashed by the browser locally, which is the only sane arrangement — verifying a download by uploading it somewhere else defeats the purpose and doubles the exposure. It also means the tool works with no network at all.
- What does a matching checksum actually prove?
- That the bytes you have are the bytes the checksum was computed over. It proves nothing about who computed it — if an attacker can replace the download they can usually replace the checksum on the same page. A signature verifies the publisher; a hash only verifies the transfer.
- Why is SHA-1 still offered?
- Because git, older release manifests and many vendor pages still publish SHA-1 digests, and you need it to check them. It is fine as a corruption check and unfit as a security control — collisions have been demonstrated in practice since 2017.
Common errors and gotchas
- Trusting a checksum published on the same page as the download, since one compromise covers both.
- Comparing hashes from different algorithms and reading the mismatch as corruption.
- Hashing a text file with different line endings and expecting a match across platforms.
- Assuming a matching hash proves authenticity, when it only proves the bytes match that value.
- Hashing a very large file in a browser tab and exhausting memory.