File hash checker

What this tool does

A hash is a short fingerprint of some data. Feed a file of any size into a hash function and out comes a fixed-length string of letters and digits; change a single byte of the file and the fingerprint changes completely. That makes hashes the standard way to check that a file is exactly the one you meant to get: a software publisher prints the hash next to the download, you calculate the hash of what you received, and if the two strings are identical, nothing was damaged or altered on the way.

This tool calculates five of them at once, SHA-256, SHA-1, SHA-384, SHA-512 and MD5, for a file or for a text you type. Everything runs inside your browser. The file is read from your disk by the page itself and is never uploaded, which matters when it is a disk image, a backup or a confidential document.

How to check a download

1. Open the File tab and drop the file on the box, or choose it.
2. Copy the hash from the download page and paste it into "Compare with a hash". The tool works out which algorithm it is from its length: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512.
3. Read the result. A green "Match" means the file's hash is identical to the one you pasted. A red "Does not match" means it is not, and the file should not be trusted.

Case, spaces and colons do not matter, and you can paste the whole line that the command-line tools print, such as the hash followed by the file name.

Hashing a text

The Text tab hashes whatever you type, encoded as UTF-8. This is useful for checking that a string you are about to use, such as a token or a configuration value, is the one somebody else has. Be careful with invisible characters: the text "abc" and the text "abc" followed by a line break are different inputs and have different hashes, which is the most common reason two people get different results for what looks like the same word.

A worked example

The SHA-256 of the three letters abc is ba7816bf 8f01cfea 414140de 5dae2223 b00361a3 96177a9c b410ff61 f20015ad, a value published in the standard that defines SHA-256. The SHA-256 of an empty input is e3b0c442 98fc1c14 9afbf4c8 996fb924 27ae41e4 649b934c a495991b 7852b855. Type abc in the Text tab and you will see the first one. Change it to abd and every character of the result changes, not just the last one.

Which algorithm to trust

• SHA-256 and the other members of the SHA-2 family (SHA-384 and SHA-512) are the ones to use today.
• SHA-1 and MD5 are broken for security purposes: collisions can be produced on purpose, so a forged file can share the hash of a genuine one. They still catch accidental damage such as a truncated download, and some older sites publish only these. If you have a choice, compare with SHA-256.

Common mistakes

• Taking the hash from the same place as the file. If an attacker can replace the download, they can replace the hash next to it. Prefer a hash published through a different channel, such as a signed announcement.
• Hashing the wrong thing. The hash belongs to the exact file offered, for example the compressed archive, not the files you extracted from it.
• A hash proves a match, not an author. To know who made a file you need a digital signature.
• Text with a hidden line break. Pasting from a terminal or a document often adds one.

Limits and speed

Files up to 4 GB are accepted. Files up to 100 MB are read once and hashed with your browser's built-in cryptography, which is fast. Larger files are read in slices of one megabyte with a progress bar and a Cancel button, so memory use stays small; this path is slower, and each algorithm you leave ticked adds time, so untick the ones you do not need. The command-line equivalents are shasum -a 256 on a Mac, sha256sum on Linux, and Get-FileHash in Windows PowerShell.