Checking that a download arrived intact
When a project publishes SHA-256: 3a7bd3... next to a file, it is inviting you to
confirm that what you received was not corrupted or swapped in transit. Drop the file on the
input box and compare. One character of difference means a different file.
The file never leaves your browser. Nothing is uploaded; it is read and hashed on this page.
Which algorithm
| Algorithm | Length | Where it belongs now |
|---|---|---|
| MD5 | 32 chars | Corruption checks at most. Never for security |
| SHA-1 | 40 chars | Compatibility with existing systems such as Git commit hashes. Do not start new work with it |
| SHA-256 | 64 chars | Today's default. Integrity, signatures, almost everything |
| SHA-512 | 128 chars | When you need a longer value. Faster than SHA-256 on 64-bit hardware |
Real collisions have been found for MD5 and SHA-1: two different files can be constructed deliberately to share a hash. That rules them out anywhere "is this really the file I think it is" has to hold up against an adversary. For catching accidental corruption they are still fine.
If you are hashing passwords
Do not use this. SHA-256 is designed to be fast, and a modern GPU tries
billions per second. Passwords want a deliberately slow function — bcrypt,
scrypt or Argon2 — with a different salt per user.
Same input, different hash?
A hash takes bytes. Differences you cannot see change the value completely.
- A trailing newline — text editors add one for you
- Line-ending style — Windows (
CRLF) and Unix (LF) are different bytes - Character encoding — this tool works in UTF-8; a file saved in a legacy encoding hashes differently
- A BOM — three invisible bytes at the front of the file
Can a hash be turned back into the original?
No, it is one-way. But short or common values (1234, password) are
found instantly in precomputed tables, so "we hashed it" is not the same as "it is safe".
Why does the browser not support MD5 natively?
WebCrypto deliberately leaves out algorithms considered unsafe. MD5 is therefore implemented directly on this page; everything else uses the browser's built-in support.