File Hash Calculator — SHA-256, SHA-1, SHA-512 Checksum

SHA-256 is the default choice: it is fast, widely published, and every OS and language can compute it. SHA-512 is equally strong and slightly faster on 64-bit hardware, but produces a longer digest. SHA-1 still appears on older download pages and in git, and it is fine for detecting accidental corruption — it is not collision-resistant enough for security decisions. This tool deliberately does not offer MD5.

Four causes, in order of likelihood: the file was downloaded in a different mode (a text-mode transfer can rewrite line endings), the publisher used a different algorithm than the one you selected, the file is a different build or version, or the download was corrupted. Compare the algorithm name and the full digest, not the first few characters, and re-download rather than assuming the file is malicious.

Not on this page: it hashes one file at a time, which keeps memory bounded and the result unambiguous. To verify a release with many files, hash the archive (zip, tar) rather than the directory — the archive is the single artefact the publisher signed or listed. If you need per-file checksums, run the tool once per file or use a local command-line tool.

A hash is a short fingerprint of a file’s exact bytes. Two files with the same hash are almost certainly identical; a file whose hash differs from the publisher’s has changed — even by one byte. It is how you verify that a download was not corrupted or tampered with, and how a forensic examiner identifies a file without sharing its contents.

SHA-256 is the sensible default and what most download pages publish. SHA-512 is longer and equally fine. SHA-1 is still widely published but is no longer considered collision-resistant, so treat it as a compatibility choice, not a secure one — if a site gives you a SHA-1 to check, use SHA-1; otherwise prefer SHA-256.

No, and deliberately. MD5 is broken for security purposes — collisions can be manufactured at will — and the browser’s own cryptography library (WebCrypto) does not offer it. If a legacy page only lists an MD5, you can compute it with a command-line tool; this page sticks to the SHA family that WebCrypto provides.

No. The file is read directly from your disk by the browser and hashed in the page; not a byte is sent anywhere. That is the whole point of doing it here rather than on a server-based checksum site — you can verify a confidential file without exposing it.

The digest is computed over the whole file in memory, so very large files (multiple gigabytes) depend on how much memory the tab can use. Files up to a few hundred megabytes are comfortable. The progress bar shows the read as it goes, so you can see it working rather than guessing.

Yes — paste it into the compare box. The tool normalises the case and whitespace of both values and tells you whether they match, which removes the usual false alarm from a stray space or a capital letter. If only the algorithm is unknown, the length of the pasted value identifies it.