Hash Generator

A hash is a fixed-length fingerprint of some data. The same input always produces the same digest, and changing a single bit changes the output completely, which is what makes it a reliable integrity check: if the digest of your download matches the one the publisher listed, the file is byte-for-byte what they released. Paste their checksum in and the comparison is done for you, which is safer than reading two long hex strings by eye.

Large files are hashed in a background thread, read in chunks, so the page stays responsive and the work can be cancelled — the progress bar covers the read and all five digests on one scale. Note what a checksum does and does not prove: it verifies integrity against the value you were given, so if an attacker can alter both the file and the published checksum, matching digests prove nothing. That is what signatures, rather than hashes, are for.

Common questions

Which algorithm should I use?

SHA-256 for anything where security matters; it is the current default for software distribution. MD5 and SHA-1 are both broken for security purposes, because it is possible to construct two different files with the same digest, but they remain perfectly good for detecting accidental corruption and are still what many projects publish. Use the algorithm the publisher used.

What does a matching checksum actually prove?

That the file you have is byte-for-byte identical to the one whose checksum you were given. It proves integrity, not authenticity: if someone could alter the file and also alter the published checksum, the two would still match. Get the checksum from a source independent of the download, and prefer a signature where one is offered.

Why is MD5 still offered if it is broken?

Because a great deal of published material still uses it, and verifying against what the publisher actually gave you is more useful than refusing. MD5 is broken in the sense that collisions can be deliberately constructed, which defeats it against an attacker. It remains reliable for catching a truncated or corrupted download, which is the everyday case.

Is my file uploaded to be hashed?

No. The file is read from your disk in chunks and hashed inside your browser, in a background thread so the page stays usable. Nothing is transmitted. That is also why very large files are limited: the whole file must fit in memory for the digest, and refusing up front is better than failing unpredictably part way through.