Hash Generator & Checksum Verifier

A cryptographic hash converts any sequence of bytes into a fixed-length digest. If your downloaded file produces the same SHA-256 value published through a trusted channel, you have strong evidence that the bytes were not corrupted or modified after that digest was created. This tool supports SHA-256, SHA-384, and SHA-512 through the browser's Web Crypto API. A selected file takes priority over the text box, and an optional expected hexadecimal value gives an explicit match or mismatch result.

Matching a checksum does not prove who created a file. If an attacker can replace both a download and the digest displayed beside it, the two will still match. Obtain the expected value from a separate trusted release page, signed manifest, package registry, or authenticated message. Digital signatures add publisher identity; hashes alone provide integrity comparison. MD5 and SHA-1 are intentionally absent because collision attacks make them unsuitable for modern security decisions, even though they remain common in legacy corruption checks.

Download a release without opening it, select the file here, choose the algorithm named by the publisher, and paste the expected hexadecimal digest. The browser reads the file bytes locally and displays Match only when every hexadecimal character is identical after ignoring whitespace and an optional SHA256:, SHA384:, or SHA512: prefix. For example, SHA-256 of the UTF-8 text hello is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Changing the capitalization to Hello produces a completely different digest.

Selecting a file grants this page access to that file's bytes for the current interaction; the implementation does not upload them or call a server endpoint. The Web Crypto digest operation receives the complete file in memory, so very large disk images may consume significant RAM or fail on memory-constrained phones. For multi-gigabyte files, use an operating-system tool such as sha256sum, shasum -a 256, or Get-FileHash, which can process data as a stream.

• Should I use SHA-256 or SHA-512? — Use the exact algorithm used by the publisher; SHA-256 is the most common modern download checksum.
• Can two different files have the same hash? — Collisions are theoretically possible, but no practical SHA-256 collision is known; weak algorithms such as MD5 and SHA-1 are a different story.
• Why does a text checksum differ between tools? — Encoding and line endings are bytes too. This page hashes UTF-8 text exactly as entered.
• Is my selected file uploaded? — No. The browser reads and hashes it locally; large files may still use substantial device memory.