How to generate a hash or verify a checksum
- Choose Text String or File Checksum.
- Type your text, or drop in the file.
- Pick the algorithm.
- Add a secret key if you need an HMAC.
- Copy the hash and compare.
Check that a download is genuine
Downloaded a file and want to be sure it hasn't been tampered with? Many download pages list a SHA-256 checksum. Drop the file in here, and if the hash matches, you've got the real thing.
It also hashes plain text with SHA-1, SHA-256, SHA-384 or SHA-512, and makes HMAC signatures if you add a secret key. The file is read in your browser, not uploaded, so it's fine to check large or private files.
Frequently asked questions
Which algorithm should I use?
Whatever the other side uses. If a site lists a SHA-256 checksum, use SHA-256. For anything new, SHA-256 is the sensible default. SHA-1 is only really here for checking older checksums.
Can I hash passwords with this for my database?
Please don't. These hashes are meant to be fast, which is exactly what you don't want for passwords. Use bcrypt, scrypt or Argon2 in your app instead.
Does uppercase or lowercase hex matter?
No, it's the same value. Use the uppercase toggle if the checksum you're comparing against is written in capitals and it's easier to eyeball.