You download an installer and the page lists a long string of hex labelled “SHA-256.” That string is there so you can prove the file arrived intact. Toolsyy’s Hash Generator calculates it for you and tells you whether it matches — and because the hashing happens in your browser, the file never leaves your machine.
What a checksum actually proves
A hash function takes any input and produces a fixed-length fingerprint. Two properties make it useful:
- It’s deterministic. The same bytes always produce the same hash — on any computer, in any program, forever. That’s why you can compare your result to one calculated by someone else years ago.
- It’s sensitive. Change one bit and the output changes completely. There’s no “close” — a hash either matches or it doesn’t.
So a matching checksum tells you the file you have is byte-for-byte the file that was published. A mismatch means something is different, and you should find out what before running it.
Step by step
- Open Hash Generator and switch to File.
- Choose your downloaded file. Large files take a moment.
- Click Generate hashes — you get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once.
- Paste the published checksum into the comparison box. The tool checks it against all five and tells you which one matched, so you don’t have to know in advance which algorithm the site used.
Case doesn’t matter — some sites publish uppercase hex, some lowercase, and both are the same value.
Which algorithm should you use?
The honest answer depends on which threat you care about, and the distinction is genuinely important.
Accidental corruption
A download that got truncated, a bad disk, a flaky connection. Any of these algorithms detects that reliably, MD5 included. Random corruption producing a matching hash is so unlikely it can be dismissed.
Deliberate tampering
Someone substituting a malicious file for the real one. Here it matters a great deal:
- MD5 is broken. Producing two different files with the same MD5 is computationally practical and has been demonstrated repeatedly — including against real certificate infrastructure. Never rely on MD5 to prove a file is genuine.
- SHA-1 is broken too. A real collision was published in 2017. It has been retired from certificates and signatures.
- SHA-256 and above are sound. No practical attack exists. This is what to use when the hash has to prove anything.
That’s why MD5 is still published everywhere despite being “broken” — for catching a corrupted download, which is the everyday case, it works fine.
One thing a checksum can’t do
If an attacker can replace the file, they can usually replace the checksum printed next to it. A hash from the same page as the download only protects against corruption in transit — not against a compromised website. Real protection means getting the expected hash from an independent channel: the project’s signing key, a separate official announcement, or your package manager’s signature verification.
Hashing text, not files
The tool also hashes typed text, which is handy for comparing two values that should be identical, or for generating a stable fingerprint of a short string.
One warning: do not use a plain hash to store passwords. These algorithms are designed to be fast, which is exactly wrong for passwords — it lets an attacker try billions of guesses per second against a stolen database. Password storage needs a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2. If you need a strong password rather than a hash, use the Password Generator.
FAQ
Is MD5 still safe to use?
It depends entirely on what you are protecting against. For detecting an accidentally corrupted download MD5 is perfectly adequate, and it is still the checksum many projects publish. It is broken against a deliberate attacker: it is computationally practical to craft two different files with the same MD5, so it must never be used where the hash has to prove authenticity. Use SHA-256 for that.
My hash does not match the published one. What now?
First check you are comparing against the right algorithm, since a page often lists several. Then re-download the file, because a truncated or interrupted download is by far the most common cause. If a fresh download still does not match, do not run the file — get it from the official source over HTTPS.
Does the file get uploaded to check its hash?
No. The file is read from your disk into browser memory and hashed locally using the browser built-in cryptography engine. Nothing is transmitted, which is what makes it safe to hash a private document or an installer you do not yet trust.
Why do the same contents always give the same hash?
A hash function is deterministic: identical input always produces identical output, on any machine and in any program. That is exactly what makes it useful for verification, since you can compare your result with one someone else calculated. Changing a single byte changes the hash completely.
Related guides
- How to generate a strong password — what to use instead of a hash for credentials.
- Base64, explained — an encoding, not a hash, and reversible by anyone.
Try it now: Free MD5 & SHA-256 Hash Generator