Check that a download is the file it should be.
Hash text or files of any size with SHA-256, MD5, SHA-3, BLAKE3 and 23 more, make HMACs, and check a download against its checksum or a SHA256SUMS file.
By Suraj KumarUpdated 3 min read
Download pages give a file's SHA-256 so you can check that what arrived is what was published. Checking it should not mean opening a terminal.
Add the file, paste the checksum.
Open the hash generator and add files, or type text. Its hashes are shown at once: MD5, SHA-1, SHA-256 and SHA-512 to start, and SHA-3, BLAKE2, BLAKE3, RIPEMD-160, CRC-32 and xxHash among the 27 a press away. Paste the checksum from the download page, in hex or Base64, and the one that matches is marked; paste a whole SHA256SUMS file and each file is matched by its name.
Files are read in pieces on your device, so a file of several gigabytes is hashed without being held whole and without being uploaded, with a progress bar and Stop.
HMACs and SRI.
Switch on Keyed (HMAC) and give a key as text, hex or Base64 to make the HMAC that APIs use to sign webhooks. Choose Base64 and SHA-384 to get the integrity value a script tag needs (Subresource Integrity). MD5 and SHA-1 are marked: two files can be made with the same one, so they are for spotting accidents, not for security.
Nothing leaves your browser.
Everything is worked out on your device: what you paste or open is never sent anywhere, and nothing is kept when you leave. A share link carries what you typed after the #, which browsers never send to a server.
Further reading
Topics: sha256 checksum · sha256 online · sha256 checksum windows · file hash · md5 checksum · md5 checksum checker · verify checksum · hash generator · hmac · sha256sums
A little less theory. A little more doing.
Try it on your own terms, with a free browser tool.
Try the tool