How to use it
- 1Choose Text to hash something you type or paste, or File to hash a file from your device.
- 2For text, the hashes update as you type. For a file, drop it on the box or click “Choose a file” – large files show a progress bar.
- 3Click the copy button next to the hash you need. Turn on Uppercase if the other system expects capital letters.
- 4To verify a download, paste the checksum published by its author into “Compare with a checksum”. The matching row turns green.
What a hash is
A hash function turns any input – a word, a document, a 4 GB disk image – into a short fingerprint of fixed length. The same input always gives the same hash, and changing a single bit gives a completely different one. That makes hashes ideal for checking that a file arrived intact and for spotting changes.
Hashing only works one way: you can’t turn a hash back into the original data. Websites that claim to “decrypt” MD5 simply look the hash up in huge tables of already-hashed words and common passwords.
Which algorithm to use
Use SHA-256 unless something else is required – it’s fast, supported everywhere and secure. SHA-384 and SHA-512 belong to the same SHA-2 family with longer output. SHA3-256 is the newer SHA-3 standard, built on a completely different design, for systems that ask for it.
MD5 and SHA-1 are broken for security: researchers can create two different files with the same hash. Don’t rely on them for signatures or anything an attacker could tamper with. They are still fine for spotting accidental corruption and for matching the checksums older sites publish. CRC32 is a quick error-detection code used in ZIP files and network protocols, not a cryptographic hash.
None of these is suitable for storing passwords. Passwords need a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.
How to verify a download
Many projects publish a checksum next to their downloads, often in a SHA256SUMS file with lines like e3b0c442… file.iso. After downloading, hash the file here and paste the published value into the compare box – the whole line works too. If the hashes match, you have exactly the file the author published; if not, download it again.
A matching checksum only proves the file is genuine if the checksum itself comes from a trustworthy place, such as the project’s own website over HTTPS. Files are read in chunks on your device, so even multi-gigabyte images are hashed without being uploaded or loaded into memory at once.
Questions and answers
Can a hash be decrypted?
No. A hash is a one-way fingerprint, not encryption, so there’s no key that turns it back. Short or common inputs can sometimes be found by looking the hash up in precomputed tables, which is why the hash of a simple password is not a secret.
Why is my hash different from the one on the command line?
Usually because of a hidden line break. echo "text" | sha256sum hashes the text plus a newline; use echo -n or printf instead. Windows line endings, trailing spaces and different text encodings change the result too. This tool hashes exactly what’s in the box, encoded as UTF-8.
Is MD5 still safe to use?
Not for security. MD5 collisions can be produced in seconds on an ordinary computer, so an MD5 checksum can’t prove a file wasn’t tampered with. For detecting accidental corruption, or when a site publishes only an MD5 checksum, it still does the job.
Are my files uploaded?
No. Files are read and hashed in your browser with WebAssembly, and nothing is sent to a server. The tool keeps working even if you go offline after the page has loaded.
How do I get a file’s hash on Windows, macOS or Linux?
On Windows, run certutil -hashfile file.iso SHA256 in Command Prompt or Get-FileHash file.iso in PowerShell. On macOS, use shasum -a 256 file.iso, and on Linux sha256sum file.iso.