Compare with an expected checksum
About this tool
This SHA-256 generator computes the SHA-256 hash of text or a file, together with SHA-512, SHA-384, SHA-1 and MD5. Text is encoded as UTF-8 before hashing, which is what most command-line tools and programming languages do. SHA hashes of text, and of files up to 128 MB, come from your browser's built-in Web Crypto digest(). Web Crypto has no MD5 and cannot hash a stream, so MD5, and every hash of larger files, comes from a small JavaScript implementation that reads the file in 8 MB chunks. Both paths were tested against Python's hashlib. Nothing is uploaded.
How to use it
- Type or paste text, or click Hash a file instead (or drop a file on the panel).
- Pick hex or Base64, and uppercase hex if the checksum you are matching uses capitals.
- Paste the expected checksum in the compare box. It accepts a bare hash, a
sha256sumline (hash filename) or a BSD line (SHA256 (file) = hash), and tells you which algorithm matched.
What a hash is
A cryptographic hash function turns input of any length into a fixed-length digest. The same bytes always give the same digest. Changing even one bit gives an unrelated-looking result, and there is no way to run the function backwards. A secure hash should also be collision resistant: it should be infeasible to find two different inputs with the same digest. NIST FIPS 180-4 defines the SHA-1 and SHA-2 algorithms used here. Its stated purpose is detecting whether a message has changed since its digest was generated.
| Algorithm | Bits | Bytes | Hex characters | Base64 characters | Collision resistance |
|---|---|---|---|---|---|
| MD5 | 128 | 16 | 32 | 24 | Broken |
| SHA-1 | 160 | 20 | 40 | 28 | Broken |
| SHA-256 | 256 | 32 | 64 | 44 | No practical attack known |
| SHA-384 | 384 | 48 | 96 | 64 | No practical attack known |
| SHA-512 | 512 | 64 | 128 | 88 | No practical attack known |
The length alone usually tells you which algorithm made a checksum, and the compare box uses that to point you to the right row.
MD5 vs SHA-256: why MD5 and SHA-1 are broken
"Broken" here means someone can deliberately build two different inputs with the same hash. The NIST National Vulnerability Database entry CVE-2004-2761 states that MD5 is not collision resistant. It cites spoofing attacks on X.509 certificates signed with MD5. For SHA-1, the SHAttered paper, "The first collision for full SHA-1" (Stevens, Bursztein, Karpman, Albertini and Markov, 2017), produced two different PDF files with the same SHA-1. The computation took about 6,500 CPU years and 100 GPU years. NIST deprecated SHA-1 for new digital signatures in 2011 and has announced that it will complete its transition away from SHA-1 by December 31, 2030.
Both still catch accidental corruption, which is why old download pages list MD5 sums. They cannot prove a file wasn't swapped by someone who could also have planned a collision. When you have a choice, use SHA-256.
Why a plain hash is the wrong way to store passwords
SHA-256 is designed to be fast, and fast is bad for passwords: an attacker with a leaked hash list can test enormous numbers of guesses. The OWASP Password Storage Cheat Sheet recommends a deliberately slow password hashing function instead: Argon2id first, then scrypt, bcrypt for legacy systems, or PBKDF2 where FIPS-140 compliance is required. These functions use a unique salt per password, so identical passwords don't produce identical hashes. Use this page for checksums. For an actual password, generate a strong one with the Password Generator and let a proper password hashing library store it.
Verifying a download with a SHA-256 checksum
- Copy the SHA-256 value from the publisher's download page, preferably over HTTPS from the official site rather than a mirror.
- Click Hash a file instead and choose the downloaded file. It is read locally, not uploaded.
- Paste the published value into the compare box. A green match means the bytes are identical.
The same check from a terminal: sha256sum file on Linux, shasum -a 256 file on macOS, or Get-FileHash file in PowerShell, whose default algorithm is SHA256 and whose examples print uppercase hex. Case doesn't matter, so the compare box ignores it for hex.
Worked example
The tool opens with the text hello (5 bytes, no trailing newline) and shows:
SHA-256 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 SHA-1 aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d MD5 5d41402abc4b2a76b9719d911017c592
Switch the output to Base64 and the SHA-256 becomes LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=: the same 32 bytes, written in 44 characters. Change the input to Hello and the SHA-256 becomes 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969, which looks nothing like the first one.
Edge cases and limits
- Trailing newline.
echo hello | sha256sumhasheshelloplus a line break and prints5891b5b5…be03. Useprintf helloorecho -n helloto match the result above. - Unicode. Text that looks identical can be different bytes.
caféwith a precomposed é is 5 bytes in UTF-8. Written as e plus a combining accent, it is 6 bytes, so the hashes differ. - Empty input. The text box shows nothing when empty. An empty file is hashed, giving SHA-256
e3b0c442…b855and MD5d41d8cd9…427e. - Large files. Files over 128 MB are read in 8 MB chunks with a progress readout, so memory use stays flat. The pure-JavaScript path is slower than Web Crypto, so expect gigabyte files to take a while.
- Base64 vs hex. Base64 is case-sensitive, so the uppercase option only applies to hex. To convert other data to and from Base64, use the Base64 Encode / Decode tool.
Common mistakes
- Hashing the file's text by pasting it, instead of hashing the file. Line endings (CRLF vs LF) and a final newline change the bytes.
- Comparing against the checksum of a different file in the same release, such as the ARM build instead of x86.
- Treating a hash as encryption. A hash can't be decrypted. If you need a unique ID rather than a fingerprint of content, use the UUID Generator.
Frequently asked questions
MD5 produces a 128-bit hash (32 hex characters) and SHA-256 a 256-bit hash (64 hex characters). More importantly, MD5 is broken: NIST's vulnerability database states it is not collision resistant, so two different files can be made to share an MD5 hash. No practical collision attack on SHA-256 is known, so use SHA-256 whenever tampering matters.
Click Hash a file instead, choose the downloaded file, then paste the publisher's SHA-256 value into the compare box. A match means the file is byte-for-byte identical. From a terminal, use sha256sum on Linux, shasum -a 256 on macOS or Get-FileHash in PowerShell.
A SHA-256 hash is 256 bits, or 32 bytes. In hexadecimal that is always 64 characters, whatever the length of the input, and in Base64 it is 44 characters. MD5 is 32 hex characters, SHA-1 is 40, SHA-384 is 96 and SHA-512 is 128, so the length tells you which algorithm you are looking at.
Most often the command added a newline. echo hello | sha256sum hashes hello plus a line break, which gives a completely different result from hashing hello alone. Use echo -n or printf to leave the newline out, and check that both sides use UTF-8 text with the same line endings.
No. Cryptographic hash functions are one-way by design. The same input always produces the same hash, but the hash cannot be converted back to the input. Short or common inputs can still be guessed by hashing candidates and comparing, which is why plain hashes are unsafe for passwords.
No. SHA-256 is fast, which lets an attacker test huge numbers of guesses against a leaked hash. OWASP recommends a slow, salted password hashing function instead: Argon2id first, then scrypt, bcrypt for legacy systems, or PBKDF2 where FIPS-140 compliance is required.
No. The file is read by your browser and hashed on your device with Web Crypto or, for MD5 and files over 128 MB, a JavaScript implementation. Nothing is sent to a server, so it works on private files and even offline once the page has loaded.