Checksum Calculator
Compute MD5, SHA-1, SHA-256, SHA-384, SHA-512 of any file, locally in your browser.
How to Use
- Drop or pick the file you want to checksum.
- All five hashes (MD5, SHA-1, SHA-256, SHA-384, SHA-512) compute simultaneously.
- Hashing is streaming — multi-GB files work without exceeding browser memory.
- Click any hash output to copy that value to clipboard.
- Compare your computed hash against a published reference to verify file integrity.
- For batch operations on many files at once, use the File Hasher tool.
—————How it works
Frequently Asked Questions
Why publish file checksums?
Software publishers post a SHA-256 next to each download so users can verify the file matches what was published. If the download was corrupted in transit or replaced by a malicious version, the hashes won't match and the user is alerted before running the bad file. Linux distributions, Tor, Docker, and most reputable software-distribution sites do this.
Should I worry about MD5?
Depends on the threat model. MD5 collisions can be fabricated by an attacker, so MD5 is unsafe for verifying authenticity (a malicious file with the same MD5 as a legitimate one can be constructed). For accidental-corruption detection (the file fell over a network cable), MD5 is fine — there's no attacker actively crafting collisions. Use SHA-256 when in doubt.
Why are several different hash algorithms shown?
To make verification flexible regardless of what reference hash is published. If the publisher posts MD5, you can match MD5; if SHA-256, match SHA-256. Modern downloads usually publish SHA-256 (or SHA-512); older downloads might still use MD5 or SHA-1. Having all five available means you can verify any of them in one operation.
What's a hash collision?
Two different files producing the same hash. The pigeonhole principle guarantees collisions exist for any fixed-output hash function — the question is how hard they are to find. SHA-256 collisions are computationally infeasible (~2<sup>128</sup> work). MD5 collisions can be generated in seconds with public tools. SHA-1 was broken by Google's SHAttered attack in 2017.
How fast is browser hashing?
Modern browsers process about 1 GB/sec for SHA-256 on consumer hardware, slower for SHA-512. The browser uses Web Crypto's native implementation which is hardware-accelerated where supported. MD5 and SHA-1 use small JavaScript implementations (Web Crypto deliberately omits the broken algorithms).
Is the file uploaded?
No. Hashing runs entirely in your browser — large files are streamed in chunks via FileReader and the Web Crypto API. You can hash sensitive files (private keys, internal source code, password databases) without exposing them to any server.
Common Use Cases
Download verification
Compute SHA-256 of a downloaded ISO, installer, or archive and compare against the publisher's posted hash.
Detecting bit rot
Capture hashes of important files at known-good times; re-hash later to detect storage corruption.
Forensic chain-of-custody
Generate cryptographic fingerprints of evidence files at acquisition time so any later modification is detectable.
Duplicate detection
Hash files and compare — same hash means byte-identical content regardless of filename or metadata.
Build artifact verification
Compare hashes of build output across machines or runs to verify reproducible builds.
Software signing verification
Compute hash of a file then verify a separate signature was made over that hash (signature verification needs another tool, but you start here).
Last updated: