Compute MD5, SHA-1, SHA-256 and SHA-512 hashes for any file — instantly, in your browser. Verify downloads, check integrity, detect duplicates. Files never upload to a server.
or click to choose a file from your device
Any file type · up to 2 GB
Paste a hash you expect (from a download page, README, etc.) and we'll match it against the computed hashes above.
Hashing happens entirely in your browser. Nothing is uploaded.
A file hash (sometimes called a checksum or digest) is a short, fixed-length fingerprint that uniquely represents the contents of a file. Two files are byte-identical if and only if they produce the same hash. Change a single byte and the hash changes completely.
Software publishers post the SHA-256 of their installer next to the download link. Run the same algorithm on your downloaded file — if the hashes match, the file wasn't corrupted in transit and wasn't replaced by an attacker.
Comparing every byte of every pair of files would take forever. Comparing hashes is instant. Backup tools, deduplication scripts and forensic software all rely on hash matching to find duplicates without re-reading files.
Hash a file before sending it, hash it after receipt — if the hashes match, the file is intact. Used in legal evidence handling, chain of custody, and large file transfers over unreliable networks.
Content-addressed storage (Git, IPFS, BitTorrent) uses hashes as identifiers — every commit, every blob, every chunk has a unique hash. Useful for power users who want stable IDs for files that survive renaming.
The classic. Fast and small — produces a 32-character hex string. Cryptographically broken since 2004 (collisions can be deliberately constructed), so don't use it for security. Still fine for: download integrity checks, deduplication, ETags, non-security checksums. Many older tools and download pages still publish MD5 alongside SHA-256.
Slightly stronger than MD5, also broken for security since 2017 (Google's SHAttered attack). Produces a 40-character hex string. Git internally uses SHA-1 for commit IDs; Linux kernel and GitHub still publish SHA-1 hashes. Use for compatibility, not for security-critical work.
The current standard. Produces a 64-character hex string. Used everywhere serious: Bitcoin, TLS certificates, software signing, modern download verification. No practical attacks known. This is the default you should reach for unless you have a specific reason to use something else.
SHA-2 family, 128-character hex string. Same security guarantees as SHA-256 but with a larger output — useful for password hashing schemes (paired with a slow KDF like bcrypt/scrypt/Argon2) and for archival systems where future cryptanalysis margin matters. Slightly slower on 32-bit systems, slightly faster on 64-bit.
Yes — completely free, no signup, unlimited use.
No. Hashing runs in your browser using the built-in Web Crypto API. Files are read in chunks and never leave your device.
The browser tool comfortably handles files up to 2 GB. The hashing is streaming — memory use stays low even for large files.
This free tool focuses on single-file hashing with all algorithms. For batch hashing across folders, the FilesDesk desktop app handles thousands of files.
MD5 collisions can be deliberately constructed by attackers, but for non-adversarial use (checking a file didn't get corrupted, finding duplicate files, building cache keys) it's perfectly fine and very fast.
Most modern projects publish SHA-256. Some legacy projects publish MD5 or SHA-1 for compatibility. Linux distro mirrors often list multiple hashes side by side.
FilesDesk processes whole folders, organises files by content, and detects duplicates across your library — using SHA-256 internally for accurate deduplication.
Try FilesDesk free