File hash calculator — MD5, SHA-256 and more for any file, without uploading

Drop one or more files to get their checksums, and paste the value from a download page to see straight away whether any of them matches; files are read on your device and never uploaded.

Live demo · real result from this tool

Drop files here

or paste with Ctrl+V · nothing is uploaded

Paste a published checksum to compare it with every digest.

Your result appears here — processed on your device.

Processed on your device — nothing is uploaded.

How to use the file hash calculator

  1. Tick the algorithms you need. MD5, SHA-1 and SHA-256 are on by default; SHA-512, SHA3-256, BLAKE3 and CRC-32 are optional.
  2. If you have a published checksum, paste it into Expected checksum (optional). Case, spaces, colons and a label such as SHA256: are ignored.
  3. Choose one or more files of any type and press Hash files.
  4. Read the table: File, Size, Algorithm and Digest for every combination. A Match or No match message appears above it when you gave an expected value.
  5. Download the table as checksums.csv if you want a record.

What it does and when to use it

Software publishers, Linux distributions and firmware makers print checksums next to their downloads so you can confirm the file arrived intact. This tool does that check in the browser, with no command line. It also helps spot duplicate files or confirm a backup matches the original.

To compare two checksum strings without a file, use the hash comparator. For text, the SHA-256 generator and MD5 generator hash pasted input directly. If you have a hash and are not sure which algorithm made it, try the hash identifier.

How it works

Each file is read in 4 MB slices with the browser’s File API. Every slice is fed into all the selected hashers from the hash-wasm library, which run as WebAssembly. The tool hashes the raw bytes exactly as stored, with no text conversion and no line-ending changes. When the last slice is done, each hasher gives its digest in lowercase hex.

An expected checksum is cleaned up as in the comparator and checked against every digest, so you need not know its algorithm. Nothing leaves your device.

Algorithm Standard Hex length Safe against tampering?
MD5 RFC 1321 32 No, collisions are practical
SHA-1 FIPS 180-4 40 No, collisions shown in 2017
SHA-256, SHA-512 FIPS 180-4 64, 128 Yes
SHA3-256 FIPS 202 64 Yes
BLAKE3 BLAKE3 specification 64 Yes
CRC-32 ISO-HDLC CRC 8 No, a checksum only

Worked examples

A small text file. A file hello.txt containing hello and a newline (6 bytes, what echo hello > hello.txt creates on Linux or macOS) gives MD5 b1946ac92492d2347c6235b4d2611184 and SHA-256 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03.

Checking against a published value. With SHA-256 and CRC-32 ticked and SHA256: 5891B5B5…F6BE03 pasted as the expected checksum, the tool reports Match: hello.txt has this SHA-256 checksum. The CRC-32 of the same file is 363a3020.

An empty file. A 0-byte file gives the SHA-256 e3b0c442…7852b855.

Limits and tips

  • Untick everything and the tool asks you to tick at least one algorithm.
  • Folders cannot be hashed directly. Select the files inside, or hash a ZIP of the folder.

Frequently asked questions

Which algorithm should I tick?
Whichever the publisher lists, usually SHA-256. If you have a choice, prefer SHA-256, SHA-512, SHA3-256 or BLAKE3. MD5 and SHA-1 are still fine for spotting a broken download, but they can be faked on purpose, so do not rely on them to prove a file was not tampered with.
Is there a file size limit?
The tool reads each file in 4 MB pieces, so it does not need to hold the whole file in memory. Very large files, such as a 10 GB disk image, work but take time; a progress bar shows how far it has got, and you can cancel.
Why does the expected checksum not match?
Most often the algorithm is wrong (an MD5 is 32 characters, a SHA-256 is 64), the download is incomplete, or you picked the checksum for a different version or platform. If the checksum is right and the file still fails, download it again.
Does a matching checksum prove the file is safe?
It proves the file is the same one the publisher hashed. If the checksum sits on the same website as the download and that site was hacked, both could be replaced. Signed checksum files, such as GPG-signed SHA256SUMS, protect against that.

Sources

  1. FIPS 180-4, Secure Hash Standard (SHS) — NIST, accessed 2026-10-07
  2. FIPS 202, SHA-3 Standard — NIST, accessed 2026-10-07
  3. RFC 1321, The MD5 Message-Digest Algorithm — IETF, accessed 2026-10-07

Written by the ToolsRift team · Last updated

Pages are drafted with AI assistance and checked by automated tests. How we write and check pages.

Was this tool useful?

Report a problem

Start typing to search every tool.

↑ ↓ to moveEnter to openEsc to close