File Hash Checker
Compute file checksums (MD5, SHA1, SHA256, SHA512, CRC32) and verify file integrity in your browser.
- Home
- Hash & Security
- File Hash Checker
What is a File Hash?
A file hash (or checksum) is a fixed-length string computed from a file's exact bytes by a hash function. Run the function again on the same file and you get the same string; change a single byte and the result changes completely. That property is what makes hashes so useful for verifying integrity.
This tool computes several popular algorithms at once: MD5, SHA-1, SHA-256, SHA-384, SHA-512, and CRC32. Each result appears on its own row with a copy button, so you can paste it wherever it is needed.
Hashing is one-way. You cannot take a hash and reconstruct the original file from it, which is exactly why hashes are used to compare data without storing the data itself. A matching hash proves the two byte streams are identical.
If you paste an expected hash and select the matching algorithm, the tool compares the values case-insensitively and reports whether the file matches. This is the standard way to confirm that a download arrived intact or that a file has not been tampered with.
All processing happens locally. The file is read with the FileReader API, the SHA family is computed with the Web Crypto API, and MD5 and CRC32 are implemented in JavaScript. Your file is never uploaded to a server, so even large or sensitive files stay on your device.
Key Concepts
Fixed-length digest
Every algorithm produces output of a constant length, whatever the file size.
Avalanche effect
A one-byte change produces a completely different hash.
One-way function
A hash cannot be reversed back into the original file.
Integrity check
Comparing hashes proves two files are byte-for-byte identical.
Algorithm choice
SHA-256 is the modern default; MD5 and CRC32 are legacy.
Client-side privacy
Files stay in the browser; nothing is uploaded or logged.
How to Use
- Select a file — Choose any file from your device. Its name and size appear once it loads.
- Choose the comparison hash type — Pick MD5, SHA-1, SHA-256, SHA-384, SHA-512, or CRC32 for the optional check.
- Paste the expected hash — If you have a hash from a download page, paste it into the optional field.
- Compute hashes — Click Compute Hashes and watch the progress bar as each algorithm runs.
- Read or copy the results — Review the match or mismatch banner, then copy any hash you need.
Hash Algorithm Guide
MD5
128-bit hash. Fast but cryptographically broken. Suitable for non-security checksums and duplicate detection.
SHA-1
160-bit hash. Considered weak against collision attacks. Still widely used for Git commits and file integrity.
SHA-256 / SHA-384 / SHA-512
Part of the SHA-2 family. SHA-256 is the current standard for file integrity verification and digital signatures. SHA-512 offers stronger security with larger output.
CRC32
32-bit checksum. Not cryptographic — designed for error detection in network/file transmission. Very fast but not collision-resistant.
Algorithm Reference
Pick the algorithm that matches your security needs and the hash you were given. The table below lists the output size and the role each algorithm plays.
| Algorithm | Output Size | Security | Best For |
|---|---|---|---|
| MD5 | 128-bit (32 hex) | Broken | Non-security checksums and duplicate detection. |
| SHA-1 | 160-bit (40 hex) | Weak | Legacy contexts that still require SHA-1 values. |
| SHA-256 | 256-bit (64 hex) | Strong | The default for file integrity and signatures. |
| SHA-384 | 384-bit (96 hex) | Strong | Higher-assurance integrity checks. |
| SHA-512 | 512-bit (128 hex) | Strong | The strongest SHA-2 option offered here. |
| CRC32 | 32-bit (8 hex) | Not cryptographic | Fast error detection in transmission. |
Worked Examples
- Verifying a download — select the file, choose SHA-256, paste the published hash, and watch the green MATCHES banner confirm the file is intact.
- Detecting corruption — a file that transferred badly produces a hash different from the source, so the check reports a mismatch.
- Comparing two copies — hash both files with the same algorithm; identical hashes mean identical bytes.
- Legacy MD5 value — when a vendor only publishes an MD5 checksum, select MD5 to compare against it.
- Quick transmission check — CRC32 gives a fast, short checksum for spotting accidental change, though not tampering.
- Copying a specific digest — use the copy button beside any row to grab just that algorithm's value.
Tips and Common Mistakes
- Match the algorithm — a SHA-256 value never equals an MD5 value, so compare like with like.
- Prefer SHA-256 or stronger — treat MD5 and SHA-1 as legacy and avoid them for security decisions.
- Beware hidden characters — pasting a hash with a trailing space or newline can cause a false mismatch; the comparison is trimmed and case-insensitive.
- Hash the exact file — even a single changed byte alters the digest, so re-download rather than editing the file.
- Hashes are not encryption — they cannot be reversed, so never expect to recover file contents from a hash.
- Watch very large files — browser memory can be a limit beyond a couple of gigabytes; most practical files are fine.
Common Use Cases
Hash checks appear throughout software distribution and data handling. These are the situations where this tool is most useful.
- Download verification — confirm an installer or archive matches the hash the publisher listed.
- Integrity monitoring — record a baseline hash and compare it later to detect changes.
- Duplicate detection — identical hashes reveal duplicate files even under different names.
- Backup validation — verify that a copied backup is byte-for-byte identical to the source.
- Forensics — document a file's hash to prove it was not altered during an investigation.
- Build artefacts — publish checksums so users can verify release binaries before running them.
Frequently Asked Questions
Is my file uploaded to a server?
No. All hash computation is performed entirely in your browser using the FileReader API and Web Crypto API. Your file never leaves your device.
Is there a file size limit?
The tool uses streaming computation (SHA via Web Crypto in chunks) to handle large files. However, browser memory may limit very large files (>2GB). Most practical files work without issues.
How do I verify a downloaded file?
Select the file, choose SHA-256 from the dropdown, paste the expected hash from the download page, and click "Compute Hashes". The tool will show a match or mismatch.
Which hash algorithm should I choose?
Use SHA-256 unless you have a specific reason not to. MD5 and SHA-1 are legacy and no longer safe against deliberate collisions, while CRC32 is only for error detection.
Is the comparison case-sensitive?
No. The expected and computed hashes are compared case-insensitively, and surrounding whitespace is ignored, so pasted values still match.
Why does my hash not match?
The file may be corrupted, truncated, or different from the published version. Confirm you are comparing the same algorithm and that the whole file was selected.
Can a hash be reversed?
No. Hash functions are one-way. You cannot reconstruct a file from its hash, which is exactly why hashes are safe to publish.
Which algorithms are computed at once?
Every run computes MD5, SHA-1, SHA-256, SHA-384, SHA-512, and CRC32 and lists them all. The dropdown only controls which one is used for the optional comparison.