Generate SHA hashes of files and text in your browser
Drop a file to compute its SHA-256 (or SHA-1, SHA-384, SHA-512) checksum, or type text and get all four digests live. Paste the published checksum next to it and a clear match/mismatch verdict tells you whether your download is intact. Everything runs on the Web Crypto API in your browser — nothing is uploaded.
How do I verify a downloaded file?
Many download pages publish a checksum next to the file — Linux ISOs, installers, firmware images. To check yours: drop the file into the file mode, pick the algorithm the page names (usually SHA-256), and paste the published value into the compare field. The comparison is forgiving about form — upper or lower case, extra whitespace, a whole sha256sum line like ba7816bf… ubuntu.iso, even the Base64/SRI notation — but strict in its verdict: a single differing character means the file is not the one that was published. If the pasted value's length matches a different SHA variant than the one you selected, the tool points that out and offers to switch instead of showing a misleading mismatch.
What is a hash and what is it for?
A hash function maps any input to a fixed-length digest. The same input always yields the same digest, and changing a single character changes the whole output — yet you can never run it backwards to recover the input. That makes hashes ideal for verifying integrity (does this download match the published checksum?) and for storing passwords without keeping the password itself.
Which algorithm should you use?
| Algorithm | Digest length | Use today? |
|---|---|---|
| SHA-1 | 160-bit (40 hex) | legacy only — broken since a practical collision in 2017 |
| SHA-256 | 256-bit (64 hex) | recommended default |
| SHA-384 | 384-bit (96 hex) | higher-security contexts |
| SHA-512 | 512-bit (128 hex) | higher-security contexts |
SHA-256 underpins TLS certificates, software signing, Git and Bitcoin. SHA-1 is shown for compatibility with older systems, but Google demonstrated a real SHA-1 collision (“SHAttered”) in 2017, so it must not be used for security. MD5 is intentionally omitted — it's broken and the Web Crypto API doesn't provide it; if you paste an MD5 value into the compare field, the tool says so instead of pretending a mismatch.
Why is there a file size limit?
The browser's native digest function takes exactly one buffer — it cannot stream. Hashing a file natively therefore means holding the whole file in memory, which this tool allows up to 256 MB. Beyond that, SHA-256 switches to a built-in streaming implementation that reads the file in small chunks with constant memory: it handles large files, just noticeably slower than the native path, and the tool estimates the wait beforehand. SHA-1, SHA-384 and SHA-512 have no streaming fallback and stay limited to 256 MB — an honest boundary rather than a silent failure.
Hashing is one-way, not encryption
You cannot decode a hash back to the text — there is no “decrypt” here. Attackers can only guess candidate inputs and compare digests, which is why long, unique inputs (and salting for passwords) matter.
Private by default
Files and text are hashed locally with your device's own resources; they never leave the browser. That makes this safe for checking sensitive documents, and it keeps working without a network connection.