Free Hash Generator & Verifier
Check that a download is exactly what its publisher released, or generate MD5, SHA-1, SHA-256, and SHA-512 hashes.
Hashed in your browser. Files are never uploaded.
How to verify a download
Find the published hash
Look on the publisher's own website, usually beside the download link or in a checksums file. Don't trust one printed by the site that offered you the file.
Add your file
Choose the file you downloaded. The hashes appear as soon as your browser finishes reading it.
Paste and compare
Paste the published value into the compare box. If you get no match, don't open the file. Delete it and download it again.
Which hash should you use?
Use the strongest one the publisher lists. SHA-256 is a sensible default when you can choose.
| Type | Length | Use it for | Status |
|---|---|---|---|
| SHA-256 | 64 characters | Verifying downloads and security checks | Recommended. It's part of the SHA-2 family NIST approves. |
| SHA-512 | 128 characters | The same, when the publisher lists it | Good. Also part of SHA-2. |
| SHA-1 | 40 characters | Spotting accidental corruption in older listings | Legacy. NIST recommends moving away from it, and researchers produced a real collision. |
| MD5 | 32 characters | Spotting accidental corruption in older listings | Legacy. RFC 6151 says it's no longer acceptable where collision resistance is required. |
What a match does and doesn't prove
- It proves your file is identical to the one that hash describes, as long as you used SHA-256 or SHA-512.
- It doesn't prove the file is safe. A matching hash only says the file is unchanged. Learn how to tell if software is real or fake.
- It depends on the source. If attackers changed both the file and the hash on a hacked site, they will still match.
When a hash isn't the right tool
- Storing passwords. Fast hashes like these are the wrong choice. OWASP recommends slow ones such as Argon2id or bcrypt.
- Keeping data secret. Hashing isn't encryption, and you can't get the original back with a key.
- Proving who made a file. Anyone can hash a file. A digital signature is what ties it to a publisher.
Prefer the command line?
Your computer can do this without a browser. Replace file.iso with your file's name, then compare the output with the published value.
| System | Command |
|---|---|
| Windows | certutil -hashfile file.iso SHA256 |
| macOS | shasum -a 256 file.iso |
| Linux | sha256sum file.iso |
Hash questions
What does it mean if the hashes don't match?
The file isn't identical to the one the hash describes. It may have been corrupted during download, or changed by someone. Don't open it. Delete it and download it again from the official source.
Is MD5 safe to rely on?
Only as a quick check for accidental corruption. The Internet standards body says MD5 is no longer acceptable where collision resistance is required, because two different files can be made to share a hash. Use SHA-256 whenever the publisher lists it.
Are my files uploaded?
No. Your browser reads the file on your device and does the math itself. This page also tells your browser to block its scripts from opening network connections, so the file and its hash aren't sent to us.
Is there a file size limit?
No fixed limit, because files are read in small pieces instead of being loaded into memory all at once. Very large files take longer. Above 256 MB we calculate SHA-256 first, and you can add the others with one click.
Why is my text hash different from another tool's?
Hashes change with any byte. A trailing space or line break, Windows or Mac line endings, or a different text encoding will all change the result. This tool hashes your text exactly as typed, in UTF-8.
Can a hash be turned back into the original?
Not directly, because a hash is one-way. But short or common text can be found by guessing and comparing, so a plain hash doesn't keep a password secret.