How to calculate a file's hash

A hash is a short fingerprint of a file. Two identical files always produce the same one; change a single byte and it changes completely.

A hash — or digest, or checksum, the words are used interchangeably — is a fixed-length summary of any amount of data. SHA-256 always produces 64 hexadecimal characters, whether you feed it a one-line note or a forty-gigabyte disk image. The useful property is that the summary is sensitive: change one byte anywhere in the file and roughly half the digest changes.

That is what makes it worth calculating. If a download page publishes a digest and your copy produces the same one, your copy is byte-for-byte what the publisher released.

Step-by-step

1. Choose your source. The tool hashes either a file or text you type. They are genuinely different jobs, so pick the right tab.
2. Add the file. Drag it in or click to browse. Large files are read in chunks, so a multi-gigabyte file works without exhausting memory.
3. Pick the algorithm. SHA-256 is the sensible default. Use SHA-384 or SHA-512 if whoever you are checking against used those.
4. Read the digest. It is grouped in fours to make comparing by eye realistic.

Hashing text has a trap in it

When you hash text rather than a file, you are hashing the exact bytes of that text — including a trailing space or newline you cannot see. This is far and away the commonest reason two people hashing "the same" string get different answers, so the tool warns you when your input ends in whitespace.

The same page also shows the UTF-8 byte count beside the character count. For plain English they match. For anything else they do not: an emoji is one character and four bytes, and it is the bytes that get hashed.

What a hash does not do

• It is not encryption. There is no key and no way back. A digest cannot be turned into the file it came from.
• It does not prove who made the file. Anyone can compute a digest for anything. If the digest and the file both come from the same compromised page, matching them proves nothing. For authorship you need a signature.
• Do not use it for passwords. Plain SHA-256 is far too fast for storing passwords. That job needs a deliberately slow function.

Which algorithm

SHA-256, SHA-384 and SHA-512 are all members of the SHA-2 family and all are considered sound. SHA-512 is not "more secure than you need" so much as differently sized; on 64-bit machines it is often slightly faster than SHA-256 despite the longer output. MD5 and SHA-1 are not offered, because both are broken for any use where somebody might deliberately construct a collision.

Frequently asked questions

Is my file uploaded anywhere?

No. The calculation runs in your browser using the Web Crypto implementation already built into it. There is no upload step and no server that could receive the file. The filename is never sent anywhere either.

Why is my digest different from the one on the website?

The commonest causes are hashing a different algorithm than the publisher used, an incomplete download, or — when hashing text — a trailing space or newline. Check the algorithm first, then re-download.

Can two different files have the same SHA-256?

In theory yes, because there are more possible files than digests. In practice no one has ever produced two files with the same SHA-256, and finding a pair deliberately is believed to be infeasible.

What size of file can it handle?

Files are read in chunks rather than all at once, so size is limited by your device rather than the page. Multi-gigabyte files are fine, they simply take longer.