Hash generator and file checksum calculator

What a hash is for

A hash function turns any file or text into a short fingerprint of fixed length. The same input always gives the same hash, and the smallest change, one bit in a 4 GB file, gives a completely different one. That makes hashes the standard way to check that a download is complete and unaltered, that two files are identical, or that a backup still matches the original.

Software sites publish the SHA-256 of their downloads next to the link. Drop the downloaded file, paste the published checksum into Verify against a checksum, and the tool tells you whether they match. You can also paste a whole checksum file, the kind named SHA256SUMS, and every file in it is checked by name.

Which algorithm

MD5 and SHA-1 are broken against deliberate tampering: with MD5, two different files with the same hash can be made in seconds. They still catch accidental damage, where nobody is trying to fool you. In our browser test, MD5 hashed a 512 MB file at 186 MB/s and SHA-256 at 104 MB/s; on real files the disk is often the slower part. MD5 vs SHA-256 has the details.

Hashing text and HMAC

Text is hashed as UTF-8 while you type, and the byte count is shown, since a hash depends on bytes, not characters: an accented letter or an emoji is several bytes. With an HMAC key, MD5 and the SHA family produce a keyed hash instead, which proves a message came from someone who knows the key. Webhooks from payment and messaging services are signed this way, so you can recompute a signature here to debug one.

Hashes are not for passwords

Fast hashes such as SHA-256 are the wrong tool for storing passwords: a graphics card can try billions of guesses a second against them. Password storage needs a deliberately slow function such as Argon2id or bcrypt, with a salt. To protect a message with a password, use encrypt text, which uses Argon2id and AES.

If something goes wrong

• The checksum does not match. Download the file again: a broken connection is the usual cause. If it still differs, the file is not the one the checksum belongs to.
• A hash of text does not match one made elsewhere. Check for a trailing new line or spaces, and the encoding; hashes are computed on exact bytes.
• It says files from the checksum list are missing. Drop all the files the list names.