File Hash Checker

File

AlgebraUppercase Output

Hash.

Show after uploading files

File

AlgebraUppercase Output

This can be compared to the "validation of expectations" below; the algorithm needs to be recalculated.

Calculate MD5, SHA-1, SHA-256, or SHA-512 hashes of any local file in your browser. Copy the result in one click or paste the expected value to auto-compare. Ideal for verifying downloads, comparing versions, and supporting digital evidence workflows.

MD5 Hash

SHA1 Hash

SHA-256 Hash

SHA512 Hash

File to Base64

HMAC Generator & Verifier

What is a file hash?

A file hash is a fixed-length 'digital fingerprint' produced by running a hash algorithm over the bytes of a file. The same file always produces the same hash, and any change to the content produces a completely different hash.

Common uses: ① verify downloaded files by comparing the hash published on the official site; ② version control, where Git / SVN identify every commit by a SHA-1; ③ file comparison, to quickly tell whether two files are identical; ④ digital forensics, where the hash serves as proof that an electronic document has not been altered.

Algorithms this tool supports: MD5 (128 bits, no longer collision-resistant), SHA-1 (160 bits, public collisions were demonstrated by Google), SHA-256 (256 bits, the current mainstream choice), and the SHA-512 family (512 bits / SHA-384 / SHA-512/256, with stronger security). Hashing is not encryption: a hash is one-way and cannot be reversed back to the file contents.

Use Cases

After downloading software, a disk image, or firmware, compare the file's MD5 / SHA-256 with the one published on the official site to confirm it has not been tampered with or corrupted during transfer.
Send a large file to a colleague and share its hash in advance so the recipient can re-check after receiving it and confirm the transfer was clean.
Generate a SHA-256 hash archive for contracts, quotations, scans, and other electronic evidence as proof that the files have not been altered afterwards.
Compare two versions of the same asset (before and after edits) by hashing them first to confirm whether they are still byte-for-byte identical.
Run consistency checks across Git repositories, backup bundles, or mirror nodes: a single SHA-256 pass is enough to confirm whether everything is in sync.

How to Use

Click the upload area and pick any local file (one file at a time).
The tool starts hashing automatically; the progress bar updates the percentage live, with larger files taking more time.
Review the hash on the right and switch algorithm, uppercase / lowercase, or SHA-512 family variant whenever you need to.
Paste the expected hash published by the official source (or sent by your contact) into the 'Expected value' field; the tool will instantly show match or mismatch.
Click 'Copy hash' to save the result to your clipboard, or click 'Recalculate' to refresh the current file.

Features

Local computation protects privacy: every hash is calculated inside your current browser, so the file is never uploaded to a server.
Four mainstream algorithms: MD5, SHA-1, SHA-256, and SHA-512 cover the vast majority of download verification and file fingerprinting use cases.
SHA-512 family variants: switch between SHA-512, SHA-384, and SHA-512/256 to match expected values of different lengths.
One-click uppercase or lowercase: lowercase is the default; tick the box to switch to uppercase when comparing against Windows tools or officially published uppercase hashes.
Auto-compare with expected value: paste the official hash into the 'Expected value' field and the tool instantly shows whether the hashes match.
Real-time progress bar: large files are read in chunks, the percentage updates live, and the browser stays responsive.
One-click hash copy: copy the result to the clipboard with the copy button so you can paste it into a spreadsheet, ticket, or chat message.

Best Practices

Prefer SHA-256 for download verification

Modern software, Linux distributions, and container images almost always publish SHA-256. Only fall back to MD5 when the official source explicitly publishes MD5 and you can trust the source; otherwise avoid the risk that comes with a weak algorithm.

Ignore case when comparing hashes

Hash algorithms have no notion of case; the tool outputs lowercase by default, but Linux / macOS command lines usually show lowercase while Windows checkers sometimes show uppercase. When values look different, first check whether the only difference is case before assuming the file is corrupted.

Hash the complete file, not a part of it

Archives, multi-file bundles, and ISO images must be hashed in their complete form. Hashing after extraction only proves that the extracted content is correct; it says nothing about whether the archive itself was modified.

Combine hash and signature for evidence workflows

A SHA-256 hash only proves file integrity, not who produced the file. When you need external evidence, layer the hash with a sender digital signature or a trusted third-party timestamp; a bare hash is not a complete evidence chain.

Switch tools for huge files or weak hardware

This tool handles files up to roughly one gigabyte well. For very large files or older devices, chunked hashing becomes slow; in that case prefer local command-line tools such as openssl dgst, certutil, or the built-in sha256sum for a faster result.

Use HMAC when you also need sender authentication

A file hash only proves content integrity; it does not prove who sent the file. If you need to confirm that the file really comes from a trusted source and has not been altered, use an HMAC generator with a shared key rather than a plain file hash.

FAQ

Should I pick MD5 or SHA-256?

Pick SHA-256 for everyday download checks, version comparisons, and deduplication. Use MD5 only when the other party only provides MD5 or when the scenario is clearly non-sensitive (for example, local file deduplication). For security-sensitive cases (digital evidence, firmware) stay with SHA-256 or stronger.

Does a difference in hash case count as a failed check?

No. Hash algorithms have no notion of case; only the display format differs. This tool outputs lowercase by default. If your expected value is uppercase, tick 'Uppercase output' and re-run; then compare characters case-insensitively.

Why does my hash not match the officially published one?

Common reasons: ① the file was corrupted during download, so download it again; ② you downloaded a different version than the one the hash was published for (double-check version, filename, and volume numbers); ③ you hashed only part of the contents (for example, after extracting an archive); ④ the official source published a different algorithm (you used MD5 while they published SHA-256).

Does this tool support SHA-224, BLAKE2, or SM3?

It currently supports MD5, SHA-1, SHA-256, and the SHA-512 family (SHA-512, SHA-384, SHA-512/256). SHA-224, BLAKE2, SM3, and similar algorithms are not supported. If you need one of them, use a local command-line tool such as openssl or sha256sum instead.

Is my file uploaded to a server? Is it safe?

No. The tool uses crypto-js to compute the hash locally inside your browser in chunks, so the file content stays on your device and in your browser memory; nothing is sent to any remote server. It is safe to use on sensitive documents, contracts, and firmware.

Can I hash multiple files at once?

The current page processes one file at a time. For batch verification, repeat the steps or switch to local command-line tools (certutil -hashfile on Windows, md5sum / shasum on macOS / Linux) that can list hashes for several files in a single run.

Should I pick SHA-512 or SHA-384?

Choose SHA-384 when the other party explicitly publishes SHA-384; otherwise default to SHA-512 for 'I want stronger security'. SHA-512/256 produces the same 64-character output as SHA-256 but uses SHA-512's compression function internally; it is useful when the system requires SHA-256 length but you want SHA-512-level collision resistance.

What is the difference between a hash and a digital signature?

A hash only proves the file content is intact; it cannot prove who sent it. A digital signature is hash plus encryption with the sender's private key: the verifier decrypts it with the public key and simultaneously checks integrity and sender identity. Use a signature check in addition to the hash whenever you need to prove the source.

Will hashing a large file freeze my browser?

The tool reads files in 2 MB streaming chunks, so files from tens to hundreds of megabytes finish quickly. Above the gigabyte range or on weaker hardware the wait becomes noticeable; in that case prefer a built-in command-line utility or openssl for large-file hashing.

Troubleshooting

Hash does not match the official one

First confirm that you downloaded exactly the version the hash was published for (filename, version number, volume number). Then check whether only the case differs and whether you hashed the full file. If everything matches and the hash still differs, redownload the file; it may have been corrupted during transfer.

Hashing a large file is slow

The tool uses 2 MB streaming chunks, so files up to several hundred megabytes usually finish in seconds. Above the gigabyte range, switch to the command line: certutil -hashfile <file> SHA256 on Windows or shasum -a 256 <file> on macOS / Linux.

Toggling uppercase changed the hash value

The hash itself did not change, only the letter case. Ignore case when comparing, or normalise both the expected value and the output to the same case before comparing.

Result did not refresh after switching algorithm

The tool re-runs the hash automatically when you change the algorithm or case option. If the result still does not refresh, click the 'Recalculate' button to force a fresh run on the current file.

Glossary

MD5: A hash algorithm that outputs 128 bits (32 hex characters). It is fast but no longer collision-resistant (Wang et al. broke it in 2004). Suitable for file fingerprinting or deduplication, but not for security-sensitive use.
SHA-1: Outputs 160 bits (40 hex characters). Google publicly demonstrated SHA-1 collisions in 2017; modern browsers and operating systems no longer recommend it, although Git's older history still depends on it.
SHA-256: A member of the SHA-2 family, outputting 256 bits (64 hex characters). The current mainstream choice, used by HTTPS, Bitcoin, modern Git repositories, and more.
SHA-512: Outputs 512 bits (128 hex characters) and is more collision-resistant than SHA-256; on long files it is also slightly faster. This tool also supports SHA-384 (96 characters) and SHA-512/256 (64 characters, the same length as SHA-256 but using SHA-512's compression function).
Hexadecimal (Hex): The most common way to display a hash, using the characters 0-9 and a-f with two characters per byte. This tool supports switching between uppercase and lowercase output.
Collision: When two different files produce exactly the same hash. Collision resistance is the core security property of a hash algorithm; practical collisions have been demonstrated for both MD5 and SHA-1.
Local computation: All hashing runs inside the current browser and device memory. The file content is never uploaded to a remote server, which makes the tool suitable for sensitive documents.

Algorithms supported by this tool

When choosing an algorithm, first check which hash the other party publishes and whether your scenario is security-sensitive.

Algorithm	Output length	Security	Typical scenario
`MD5`	128 bits / 32 chars	Weak (collisions broken)	Local dedup, legacy compatibility
`SHA-1`	160 bits / 40 chars	Weak (collisions broken)	Git history compatibility
`SHA-256`	256 bits / 64 chars	Strong	Downloads, firmware, evidence (recommended)
`SHA-384`	384 bits / 96 chars	Strong	High security, protocol-mandated
`SHA-512`	512 bits / 128 chars	Stronger	High security
`SHA-512/256`	256 bits / 64 chars	Strong	Need SHA-256 length but SHA-512 core

Algorithm recommendation by scenario

The best algorithm for the same file differs depending on the scenario you are using it in.

Scenario	Recommended algorithm	Core value
Download verification (software, image, firmware)	`SHA-256`	Universal, widely supported
Git commit fingerprint	`SHA-1`	History compatibility
Local file deduplication	`MD5`	Fast, low risk
Digital evidence	`SHA-256 + signature`	Hash plus signature, court-friendly
Transfer integrity check	`SHA-256`	Both sides can compute, easy to compare
Protocol requires a specific length	`SHA-384 / SHA-512/256`	Meets protocol constraints