File Hash Generator
Checksum one file or a hundred. Each file is streamed through the hash function in your browser, so size is limited by your device rather than by an upload, and nothing ever leaves it.
{{ textCount }}
{{ textError }}
{{ r.value }}
{{ legacyNames }} {{ legacyNames.indexOf(' and ') === -1 ? 'is' : 'are' }} selected. Practical collisions are public for both, so treat the result as a checksum for spotting accidental corruption — not as evidence that a file is authentic.
Drop files here to hash them
Up to 100 files · any size · read in 4 MB chunks, never uploaded
Files are read, not uploaded. Each one is streamed through the hash function in chunks straight from disk, so a multi-gigabyte image never lands in memory and never leaves your device.
{{ f.error }}
{{ r.value }}
The key never leaves this page. It is not sent to a server, not saved to local storage, and not written into the exported files.
{{ hmacError }}
{{ hmacResult }}
HMAC is not a hash with the key glued on the front. It runs the key through the hash
twice with two different pads, which is what makes it resistant to the length-extension
attacks that break a naïve hash(key + message).
Drop the file you want to check
Hashed in your browser · never uploaded
{{ lengthProblem || vError }}
Hash matches
The {{ vResult.label }} digest of {{ vFile.name }} is identical to the hash you supplied, so this is the file that checksum describes. Letter case and surrounding whitespace were ignored.
Both {{ vResult.computed }}
Hash does not match
This file is not the one that checksum describes. Either the download is incomplete or corrupted, or the file has been altered. Downloading it again is the first thing to try.
Computed {{ vResult.cHead }}{{ vResult.cChar }}{{ vResult.cTail }}
Expected {{ vResult.eHead }}{{ vResult.eChar }}{{ vResult.eTail }}
First difference at character {{ vResult.diffAt + 1 }}.
Paste a hash into both boxes to compare them.
Hashes match
Both are the same {{ cmpResult.len }}-character value, so they identify identical content.
Ignored while comparing: letter case, spaces, line breaks, and any
sha256:-style prefix.
Both {{ cmpResult.a }}
Length {{ cmpResult.len }} — consistent with {{ cmpResult.guess }}.
Hashes are different
These are different lengths — {{ cmpResult.a.length }} and {{ cmpResult.b.length }} characters — so they are digests from two different algorithms, and comparing them tells you nothing about the content.
These two digests differ, so they describe different content.
Hash A {{ cmpResult.aHead }}{{ cmpResult.aChar }}{{ cmpResult.aTail }}
Hash B {{ cmpResult.bHead }}{{ cmpResult.bChar }}{{ cmpResult.bTail }}
First difference at character {{ cmpResult.diffAt + 1 }}.
Text, files and secret keys are hashed in your browser. Nothing you enter is ever uploaded to a server.
Checksumming files in the browser
A file checksum answers one question: is this byte-for-byte the file I expected? Publishers post a digest next to a download so you can tell a truncated transfer or a tampered mirror from the real thing. Computing it should not require handing the file to anyone.
Why file size is not a limit here
The file is never loaded whole. It is read in four-megabyte slices, each one fed into the hash function's running state and then discarded, which is what a hash function is built to allow. Memory use stays flat whether the file is 2 KB or 20 GB, and because the work is done in measurable pieces there is a genuine progress figure rather than a spinner.
Several algorithms cost one read
Each slice is handed to every selected algorithm before the next slice is read, so producing MD5, SHA-256 and SHA-512 together takes one pass over the file rather than three. Reading from disk is the slow part; the arithmetic is nearly free by comparison.
Files are processed one at a time
Deliberately. Several concurrent readers contend for the same disk, so a batch finishes sooner in sequence and each progress bar means something. A file that cannot be read — a folder, or something the browser is denied access to — is reported on its own row and the batch continues.
See also the Hash Checker.
Frequently asked questions
How large a file can this handle?
There is no fixed limit. Files are read in 4 MB chunks and fed to the hash function incrementally, so the whole file is never held in memory at once. Multi-gigabyte disk images work; they simply take longer.
Why does it hash one file at a time?
Because several concurrent readers compete for the same disk and everything slows down. Sequential processing finishes the whole batch sooner and keeps each progress bar meaningful.
Can I get several algorithms in one pass?
Yes. Tick as many as you like and every chunk is fed to all of them together, so ten algorithms cost one read of the file rather than ten.
Does a folder work?
No — browsers hand a folder over as an unreadable entry. Open it and drop the files inside instead. Any item that cannot be read is reported on its own row and the rest of the batch continues.
What is the TXT export format?
One line per result: the digest, the algorithm, then the filename. It is deliberately close to the layout of sha256sum output so it is easy to read and to diff.