My tools

File hash checker

Drop a file and compare its six checksums with the value the publisher gave you — no upload.

No file yet

Drop a file anywhere on this card, or use Choose file.

Any file type — checksums are computed from the bytes, not from the extension.

MD5 · SHA-1 · SHA-256 · SHA-384 · SHA-512 · CRC32

The file is read in your browser and never uploaded.

CRC32 is a checksum, not a cryptographic hash: it catches copy errors but does not resist tampering.

How to use it

  1. Choose, drop or paste a file — hashing starts immediately; there is no button to press.
  2. Six checksums appear at once. Copy the one you need with its row button, or download all six as a .txt report.
  3. Paste the checksum published by the download page into the expected-value box. The algorithm is recognised from the hex length, and the result says whether it matches.
  4. If a match is not what you expected, check that you pasted the whole value and that it belongs to this file — checksums compare byte for byte.
  5. The file never leaves your browser: there is no upload, no storage, and no request carrying the file or its name.

Example

File contents (hello.txt)

hello world

Checksums

MD5:     5eb63bbbe01eeed093cb22bb8f5acdc3
SHA-1:   2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
SHA-384: fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3e417cb71ce646efd0819dd8c088de1bd
SHA-512: 309ecc489c12d6eb4cc40f50c902f2b4d0ed77ee511a7c7a9bcd3ca86d4cd86f989dd35bc5ff499670da34255b45b0cfd830e81f605dcf7dc5542e93ae9cd76f
CRC32:   0d4a1185

The sample file contains the eleven characters above, hashed as eleven UTF-8 bytes. In the Chinese page the same five characters “你好，世界” are 15 bytes, and the Arabic sample is 25 bytes: the size shown is the number of bytes actually hashed, not the character count.

Rules, limits and known issues

  • MD5 and SHA-1 are broken and must not be used for anything security-related: collisions can be produced on demand. They are here for non-adversarial integrity checks only.
  • CRC32 is not a cryptographic hash. It detects accidental corruption and is used by ZIP and PNG, but it cannot resist a deliberately crafted file.
  • A matching checksum only means that the bytes you have match the value you compared against. If the page publishing that value was tampered with, or the value came from an untrusted source, a match does not make the file safe. This tool does not scan for malware and does not verify signatures.
  • The whole file is hashed byte for byte: no trimming, no decoding, no handling by extension, and renaming the file does not change the result. A .zip is hashed as the archive itself, not as the files inside it.
  • The algorithm is recognised by hex length. A 32-character value is always treated as MD5; a truncated SHA-256 cannot be recognised and will be compared as MD5, which reports a mismatch.
  • If you paste two different checksums, the result is “cannot determine” instead of a guess. Paste exactly one value, or one complete command-line output line.
  • Only one file at a time. Dropping several files uses the first and ignores the rest; to check a folder, use sha256sum -c or Get-FileHash on your own machine.
  • There is no hard size limit. Reading is chunked, so memory use stays around one 4 MiB block regardless of file size; files over 1 GiB get a warning and can be cancelled at any time. Speed depends on the device and the disk.
  • Hashing runs in the background. On very old browsers without Worker support the page falls back to the main thread, which may feel slower on large files.
  • Not supported: HMAC and other keyed digests, SHA-3, BLAKE3, RIPEMD, Whirlpool, CRC-16, batch verification, fetching a file from a URL, and comparing more than one checksum at once.
  • Nothing is stored: no history, no local storage, no URL parameters. Reloading the page discards the file and the results.

Checksums usually show up alongside these.

Hash generator (text)

JWT encoder / decoder

EXIF viewer