Hash & Checksum

Calculate checksums for files or text — streams large files without loading them into memory.

Choose filess or drop them anywhere on this page Processed on your device — never uploaded

This tool does its work with JavaScript in your own browser — that is exactly why your files never get uploaded. Please enable JavaScript to use it.

How to hash & checksum

Drop in the file you want to verify — or type text directly into the input area.
Choose one or more algorithms.
Paste the expected hash in the compare field to check the download is intact.

About this tool

Verifying a download with a checksum is the only reliable way to confirm that a file arrived intact and has not been tampered with. This matters most for OS installer images, software packages from third-party mirrors, and large archives where a single flipped bit can corrupt the entire payload. The published SHA-256 or SHA-512 hash is a fingerprint: if the computed hash of what you downloaded matches the hash the publisher posted, the files are identical.

Streaming is the significant technical detail here. Naive implementations load the file into memory entirely, which is impractical for large ISOs or disk images — a 20 GB file does not fit in a browser tab's memory limit. This tool reads the file in chunks, passing each through the incremental hash state update, so memory usage stays flat throughout. The result is the same as hashing the file in one pass; it just does not exhaust your RAM doing it.

Because everything runs locally, sensitive files — SSH keys, configuration files containing credentials, confidential documents — can be hashed without the content ever leaving your machine.

Questions

When should I use SHA-256 versus SHA-512?

SHA-256 is the standard choice for download verification — every major OS and package manager uses it. SHA-512 is slower to compute but has a larger output (512 bits versus 256 bits), making brute-force attacks more expensive. For verifying a file download against a published checksum, SHA-256 is correct. For password hashing, use neither — use bcrypt, scrypt or Argon2 instead.

Is MD5 still useful?

MD5 is not suitable for any security-sensitive use: it has known collision vulnerabilities and should not be trusted for verifying signatures or certificates. For simple accidental-corruption detection — checking that a download completed without a bit flip — it still works. Many older software mirrors still publish MD5 checksums.

How does it handle large files without running out of memory?

The file is read as a stream through the File API, passing chunks to the hash function one at a time. The function only needs the current block and the running state — typically a few kilobytes — rather than the entire file. A 20 GB ISO will hash at roughly disk-read speed without the tab ever loading the full content into memory.

Can I hash text instead of a file?

Yes. There is a text input mode for hashing short strings, which is useful for verifying API signatures, checking that a password hash matches, or testing hash implementations.

Hash & Checksum

How to hash & checksum

About this tool

Questions

Related tools