Batch File Hasher
Hash many files at once and export the manifest (TSV, JSON, or sha256sum).
How to Use
- Drop multiple files into the input area, or drop a folder (Chromium/Edge/Firefox support folder drops with preserved paths).
- Pick the hash algorithm: SHA-256 (recommended), SHA-1 (legacy), MD5 (checksums only), or SHA-512.
- Pick the export format: <strong>sha256sum</strong> (Unix-style, compatible with the sha256sum command), <strong>TSV</strong> (tab-separated for spreadsheets), or <strong>JSON</strong> (for programmatic use).
- Files are hashed in parallel; large files are streamed in chunks so memory stays bounded.
- Files are sorted alphabetically in the output for reproducible manifests.
- Click Download to save the manifest file.
| Name | Size | Hash |
|---|
Manifest formats
Frequently Asked Questions
Why generate a hash manifest?
<strong>Integrity verification</strong> — distribute the manifest alongside files so recipients can verify their copies are intact. <strong>Backup audit</strong> — compare manifests over time to detect bit-rot or unauthorized changes. <strong>Build reproducibility</strong> — capture exactly what you built so the same hashes prove identical output. <strong>Forensic chain-of-custody</strong> — establish that evidence files weren't modified during analysis.
What's the sha256sum format?
Unix convention: <code><hash> <filename></code> per line, double-spaced separator. Compatible with the <code>sha256sum -c</code> command on Linux/macOS to verify a manifest. The format is also accepted by Windows tools like <code>certutil -hashfile</code>. Hashes are lowercase hex; filenames are relative paths.
Will it handle large files?
Yes — files are read and hashed in chunks (typically 1 MB at a time) using the Streams API and Web Crypto. Memory usage stays bounded regardless of file size, so multi-GB files work fine. Total time scales with file size; expect ~1 GB/sec on modern hardware.
How do folder drops preserve paths?
Chromium-based browsers (Chrome, Edge) and recent Firefox support the WebkitGetAsEntry API for folder drops. Each file's relative path within the dropped folder is captured. The output manifest preserves these paths so you can verify the entire folder structure. Safari has limited folder-drop support.
Which algorithm should I use?
<strong>SHA-256</strong> for new uses — secure and universally supported. <strong>SHA-1</strong> only for compatibility with older systems (e.g., comparing against a SHA-1 manifest you didn't create). <strong>MD5</strong> for non-security checksums where speed matters and you trust the source. <strong>SHA-512</strong> when you want extra collision-resistance margin or are matching SHA-512 manifests from other sources.
Are files uploaded?
No. Hashing happens entirely in your browser. You can hash sensitive files (private keys, source code, internal documents) without exposing them to any server.
Common Use Cases
Bulk file delivery verification
Generate a manifest before sending files; recipient verifies every file matches.
Backup integrity check
Compare manifests of a backup to its source — any mismatch indicates corruption or modification.
Software distribution
Publish SHA-256 hashes for all release artifacts so users can verify downloads.
Source code archival
Capture cryptographic fingerprints of release source trees for long-term archival.
Compliance documentation
Generate evidence-of-state manifests for regulatory or audit purposes.
Build reproducibility
Compare build outputs across time, machines, or contributors to verify reproducible builds.
Last updated: