How to use the file hash calculator
- Tick the algorithms you need. MD5, SHA-1 and SHA-256 are on by default; SHA-512, SHA3-256, BLAKE3 and CRC-32 are optional.
- If you have a published checksum, paste it into Expected checksum (optional). Case, spaces, colons and a label such as
SHA256:are ignored. - Choose one or more files of any type and press Hash files.
- Read the table: File, Size, Algorithm and Digest for every combination. A Match or No match message appears above it when you gave an expected value.
- Download the table as
checksums.csvif you want a record.
What it does and when to use it
Software publishers, Linux distributions and firmware makers print checksums next to their downloads so you can confirm the file arrived intact. This tool does that check in the browser, with no command line. It also helps spot duplicate files or confirm a backup matches the original.
To compare two checksum strings without a file, use the hash comparator. For text, the SHA-256 generator and MD5 generator hash pasted input directly. If you have a hash and are not sure which algorithm made it, try the hash identifier.
How it works
Each file is read in 4 MB slices with the browser’s File API. Every slice is fed into all the selected hashers from the hash-wasm library, which run as WebAssembly. The tool hashes the raw bytes exactly as stored, with no text conversion and no line-ending changes. When the last slice is done, each hasher gives its digest in lowercase hex.
An expected checksum is cleaned up as in the comparator and checked against every digest, so you need not know its algorithm. Nothing leaves your device.
| Algorithm | Standard | Hex length | Safe against tampering? |
|---|---|---|---|
| MD5 | RFC 1321 | 32 | No, collisions are practical |
| SHA-1 | FIPS 180-4 | 40 | No, collisions shown in 2017 |
| SHA-256, SHA-512 | FIPS 180-4 | 64, 128 | Yes |
| SHA3-256 | FIPS 202 | 64 | Yes |
| BLAKE3 | BLAKE3 specification | 64 | Yes |
| CRC-32 | ISO-HDLC CRC | 8 | No, a checksum only |
Worked examples
A small text file. A file hello.txt containing hello and a newline (6 bytes, what echo hello > hello.txt creates on Linux or macOS) gives MD5 b1946ac92492d2347c6235b4d2611184 and SHA-256 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03.
Checking against a published value. With SHA-256 and CRC-32 ticked and SHA256: 5891B5B5…F6BE03 pasted as the expected checksum, the tool reports Match: hello.txt has this SHA-256 checksum. The CRC-32 of the same file is 363a3020.
An empty file. A 0-byte file gives the SHA-256 e3b0c442…7852b855.
Limits and tips
- Untick everything and the tool asks you to tick at least one algorithm.
- Folders cannot be hashed directly. Select the files inside, or hash a ZIP of the folder.
Frequently asked questions
Which algorithm should I tick?
Is there a file size limit?
Why does the expected checksum not match?
Does a matching checksum prove the file is safe?
Sources
- FIPS 180-4, Secure Hash Standard (SHS) — NIST, accessed 2026-10-07
- FIPS 202, SHA-3 Standard — NIST, accessed 2026-10-07
- RFC 1321, The MD5 Message-Digest Algorithm — IETF, accessed 2026-10-07
How do we know nothing is uploaded? Test it yourself on the privacy proof page.