Hash generator and checksum checker

Type text or choose a file to get its SHA-256, SHA-512, SHA-384, SHA-1 and MD5 hashes. Paste the checksum from a download page and it tells you whether the file matches.

Hash
Hashed as UTF-8, exactly as typed. A line break at the end changes the hash: echo adds one, printf and echo -n do not.
Show as

Type text or choose a file to see its hashes.

The same check on the command line

shell 
# Linux
sha256sum file.iso
# macOS
shasum -a 256 file.iso
# Windows (PowerShell)
Get-FileHash 'file.iso' -Algorithm SHA256

Verifying an ISO before installing it on a server? Compare servers by what they cost each month. From €3.02 a month today, among 2,243 servers.

Compare servers Password generator

Works in your browser: nothing you type is sent anywhere.

How it works

A hash function turns any amount of data into a short fixed-length value. Change a single bit of the input and the result changes completely, and with SHA-256 nobody can find two different inputs with the same value. That is why download pages publish a hash: if your copy gives the same one, it is the same file, byte for byte.

The page uses your browser's built-in Web Crypto API for SHA-1, SHA-256, SHA-384 and SHA-512, and a small MD5 implementation of its own, because browsers do not offer MD5. Text is hashed as UTF-8 bytes. A file is read into memory and hashed there; nothing is uploaded. Web Crypto needs the whole file at once, so the practical limit is a few hundred megabytes, depending on your device.

The checksum field accepts a bare hash in upper or lower case, groups separated by spaces or colons, a line from sha256sum output, a BSD-style line like SHA256 (file.iso) = …, or Base64. It finds the hash in it and compares it with all five results.

Example

The text “abc” (3 bytes, no line break) has the SHA-256 hash ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad and the MD5 hash 900150983cd24fb0d6963f7d28e17f72, the test values in FIPS 180-2 and RFC 1321. An empty input gives the SHA-256 e3b0c442…b855: if you see that for a file, the file is empty.

Questions

What is SHA-256 used for?

To check that data is exactly what it should be. Linux distributions publish SHA-256 sums of their ISO images, package managers check every package against one, Git and Docker name content by its hash, and TLS certificates and code signatures are built on it. No practical way to find two inputs with the same SHA-256 is known.

Is MD5 safe to use?

Not for security. Researchers have been able to create different files with the same MD5 since 2004, and since the Flame malware in 2012 such collisions have been used in real attacks. MD5 still catches a download damaged by accident, but someone who can change the file can also make it match. For anything that matters, compare SHA-256. SHA-1 is broken the same way since 2017.

How do I verify an ISO file?

Download the ISO and the checksum the project publishes, ideally from its own site over HTTPS. Choose the file here and paste the checksum into the field: a green match means your copy is identical. On a server, run sha256sum on the file and compare, or sha256sum -c with the SHA256SUMS file. Projects that also sign the checksum file let you check the signature with gpg.

Can a hash be reversed to get the text back?

No. A hash keeps far less information than the input, so there is no way to compute the input from it. Short or common inputs can still be found by trying candidates, which is why passwords are stored with slow, salted functions such as bcrypt or Argon2, not with a plain SHA-256 or MD5.

Why is my hash different from the one on the command line?

Usually a line break. echo "text" | sha256sum hashes the text plus a newline; use echo -n or printf to leave it out. Windows line endings (CR LF) and a byte-order mark at the start of a file also change the result. For files the hash is always of the exact bytes, so a match here and in sha256sum means the same file.