Frequently Asked Questions
How do I get the hash or checksum of a file?
Select a local file or drag and drop it, choose an algorithm — MD5, SHA-1, SHA-256, or SHA-512 — and the tool computes the checksum right in your browser. You can paste a known hash to verify a match, then copy the digest or download a report. The file is read locally and never uploaded, so even large or private files stay on your device.
Does my file get uploaded, and does it work offline?
No upload, and yes it works offline. The file is read and hashed in your browser using the Web Crypto API (with an in-page routine for MD5) — there's no server receiving it, no logging, and no tracking. This is the key difference from many checksum sites that upload your file. Once the page has loaded it keeps working with no internet connection.
Which algorithms are supported?
MD5, SHA-1, SHA-256, and SHA-512. MD5 (128-bit) and SHA-1 (160-bit) are fast and still common on download pages for quick integrity checks, but they're cryptographically broken. SHA-256 and SHA-512 are part of the secure SHA-2 family and are the right choice when the file's source might be untrusted. Always pick the same algorithm the publisher used, or the digests won't match.
How do I verify a download's checksum?
Download the file, then hash it here with the same algorithm the publisher listed (usually SHA-256), and paste their published value into the compare field. The tool reports whether it matches. A match means your copy is byte-for-byte identical to the one they hashed. A mismatch means the file was corrupted in transit, incomplete, or altered — re-download and check again.
What's the difference between this and the text Hash Generator?
This tool is optimized for files — select or drag a file, hash its raw bytes, compare against a checksum, and export a report. The Hash Generator focuses on text you type or paste (and small files), with hex/Base64 output options. Same underlying algorithms; different workflow. Use this one for downloads and file integrity, and the text tool for hashing strings and snippets.
Are MD5 and SHA-1 checksums trustworthy?
For catching accidental corruption, yes — if a file was truncated or garbled in transit, even MD5 will reveal it. For defending against a deliberate attacker, no: both are broken, and a motivated adversary can craft a different file with the same MD5 or SHA-1. So treat an MD5/SHA-1 match as "probably not corrupted", and use SHA-256 or SHA-512 when the file could have been tampered with on purpose.
Can I hash very large files?
Usually yes. Because hashing runs locally, the limit is your device's memory and CPU, not a server upload cap — and crucially, a multi-gigabyte file is never sent anywhere. Large files simply take longer to read and process; a progress indicator helps you track it. This local-only approach is exactly why it suits big files that would be impractical or unsafe to upload.
What is the downloadable report?
It's a small summary you can save or share: the file's name and size, the algorithm used, the resulting digest, and — if you compared against a known hash — the match verdict. It's handy for record-keeping, for attaching to a release, or for passing verification results to a teammate. Like everything else, the report is generated locally from the hash you just computed.
Why does my file's hash differ from the website's?
The usual culprits: you used a different algorithm than the one published, the download was incomplete or corrupted, you hashed the wrong file (or a different version), or you're comparing hex to Base64. Re-download the file, hash it with the exact algorithm listed, and compare the same format. If it still differs, the file genuinely doesn't match — don't trust it.
Does a matching hash guarantee the file is safe?
No — it proves integrity, not safety. A match confirms your file is identical to the one the publisher hashed; it doesn't confirm that file is free of malware or that the publisher is trustworthy. And if an attacker compromised the page and posted both a malicious file and its matching hash, verification would still "pass". Checksums verify that a file wasn't altered in transit, assuming you trust the source of the hash.
What does "byte-for-byte identical" mean?
It means two files contain exactly the same bytes in the same order — not just the same visible content. Because a hash is deterministic, identical bytes always produce an identical digest, and even a one-byte difference produces a completely different one. So a matching checksum is strong evidence that two files are truly the same file, which is why checksums are used to verify copies and downloads.
Is it free, and are there limits?
Yes, completely free — no payment, no signup, no account, and no usage caps or watermarks. Since everything runs in your browser, there's nothing for us to meter; the only practical limit is your device's performance on very large files. Use it as much as you like, including offline once the page has loaded.
Still have questions?
If you can't find the answer you're looking for, feel free to contact our support team.