File Hash Generator
Generate SHA-256, SHA-1, and MD5 checksums for any file. Paste an expected hash to verify file integrity.
Your files are processed locally in your browser and are not uploaded to our server.
Drop a file here, or click to select
Any format · Max 500 MB
How It Works
Web Crypto API
SHA-256 and SHA-1 use the browser's built-in SubtleCrypto.digest() — fast and trustworthy.
Pure JS MD5
The Web Crypto API excludes MD5 (insecure for crypto). This tool includes a pure JS implementation that produces correct RFC 1321 digests.
Files Never Leave
All hashing runs locally in your browser. Your file is never uploaded to any server.
One-Click Verification
Paste an expected hash from an official release page and get an instant match / no-match result.
Algorithm Comparison
| Algorithm | Output Bits | Hex Length | Security | Use Case |
|---|---|---|---|---|
| SHA-256 | 256 bits | 64 chars | Secure | Software download verification, digital signatures, file integrity |
| SHA-1 | 160 bits | 40 chars | Deprecated | Git commit IDs, legacy system compatibility, non-security checksums |
| MD5 | 128 bits | 32 chars | Insecure | File deduplication, cache keys, non-security fingerprints |
Command-Line Equivalents
For very large files or automated pipelines, command-line tools are more efficient:
| Environment | Command |
|---|---|
| Linux / macOS (SHA-256) | sha256sum filename.zip |
| Linux / macOS (MD5) | md5sum filename.zip |
| macOS (MD5 alternative) | md5 filename.zip |
| Windows (SHA-256) | certutil -hashfile filename.zip SHA256 |
| Windows (MD5) | certutil -hashfile filename.zip MD5 |
| Node.js (SHA-256) | require('crypto').createHash('sha256').update(fs.readFileSync('f')).digest('hex') |
| Python (SHA-256) | import hashlib; hashlib.sha256(open('f','rb').read()).hexdigest() |
Related Tools
Frequently Asked Questions
Which hash algorithm should I use?
Use SHA-256 for security-sensitive purposes such as verifying software downloads. SHA-1 is still used in legacy systems but is no longer considered secure for cryptographic use. MD5 is fast and widely used for non-security checksums, but should not be used for anything security-critical.
Is my file uploaded to a server?
No. SHA-256 and SHA-1 use the browser's built-in Web Crypto API (SubtleCrypto.digest). MD5 is computed with a pure JavaScript implementation. Your file never leaves your device.
How do I verify a file download?
Download the file, then drop it into this tool. Copy the SHA-256 hash from the software's release page, paste it into the Verify box, and select SHA-256. A green match means the file is exactly as published.
What is the maximum file size?
The tool supports files up to 500 MB. Larger files are read entirely into memory as an ArrayBuffer before hashing, so available RAM is the practical limit. For very large files, command-line tools like sha256sum (Linux/macOS) or certutil (Windows) are more efficient.
How is the MD5 hash computed if the Web Crypto API does not support MD5?
MD5 was intentionally excluded from the Web Crypto API because it is cryptographically broken. This tool includes a pure JavaScript MD5 implementation that runs in your browser. It produces correct RFC 1321 MD5 digests, but you should not use MD5 for security purposes.
Can I hash a text string instead of a file?
This tool hashes the raw binary content of files. If you want to hash a text string, you can put it in a .txt file and drop it here. The hash will cover the raw UTF-8 bytes of the text.