File Hash Checker
Hash a file with MD5, SHA-1, SHA-256 and SHA-512, and check it against a published digest.
File
Drop a file here, or choose one. Nothing is uploaded, so there is no server-side size limit — the only limit is this browser's memory, because WebCrypto has no way to hash a stream.
Algorithms
MD5 and SHA-1 are here because publishers still print them, not because they are safe. Both have practical collision attacks — someone can build a second file with the same digest. Use them to check that a download arrived intact, never to decide that a file is trustworthy.
Check against a published hash
Any of the usual shapes works: a bare digest, a sha256sum line, or the SHA256 (file.iso) = … form. The comparison is case-insensitive.
Hashes
Save what you type here, on this device? Your work would go into this browser's local storage, so a refresh or a trip to another tool does not wipe it. It is never uploaded, and there is no account.
Being straight about the trade-off: anything kept there can be read by anyone who can use this browser profile, and by any script that later runs on this site. A tool page can hold a private key, a password or a signed token. Saving is convenient; it is not private.
Saved on this device.
Not saved — this page forgets your work when you leave it.
About this tool
Compute MD5, SHA-1, SHA-256 and SHA-512 for a file in your browser, then check the result against a hash you were given. The file is read locally and never uploaded. Pasting a published digest — including a whole sha256sum line — turns the result into a verdict rather than a row of hex for you to compare by eye, and re-pasting a different digest re-compares without reading the file again.
Questions
- Is MD5 still worth using?
- For checking that a download arrived intact, yes, and it is still what a lot of publishers list. For anything where someone might have a reason to give you a file that differs from the one you asked for, no — MD5 and SHA-1 are both broken for that purpose and collisions can be constructed deliberately. Use SHA-256 for anything security-related. The page offers all four because the digest you were given decides which one you need, not the other way round.
- Why is SHA-512 off by default?
- Because it is rarely the one published, and every algorithm you tick is another pass over the file. All four can be ticked at once if you want them; the checkboxes only control which rows are computed.
- What happens with a very large file?
- It is hashed in chunks, so memory does not grow with the file — but there is a 256 MB ceiling, and the page states it up front rather than failing halfway. Beyond that, use sha256sum on the command line, which is faster and has no such limit.
- I pasted a hash and it said the lengths are not comparable. What does that mean?
- That the digest you pasted is a different length from every algorithm currently ticked, so the two cannot be compared at all. Calling that a mismatch would be a false accusation against the file, so the page says which of the two situations you are in and tells you to tick the matching algorithm.