Step-by-step guide: How to Verify a File Checksum (MD5, SHA-256)
How to use the Hash Generator
- Type or paste text, or switch to File and choose a file. Hashes are calculated automatically.
- All five algorithms are shown together; copy the one you need.
- To verify a download, paste the checksum published by the provider into Compare with an expected hash. The matching algorithm is highlighted, or you are told that nothing matches.
- For API request signing, enter the shared secret as the HMAC key; the SHA results then become HMAC-SHA values.
Example: well-known test values
The sentence The quick brown fox jumps over the lazy dog has these standard digests, which you can use to confirm any hashing tool is working correctly:
MD5 9e107d9d372bb6826bd81d3542a419d6
SHA-1 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
SHA-256 d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592Changing a single character — “dog” to “cog” — produces completely different hashes. That sensitivity is what makes hashes useful for detecting changes.
What a hash is
A cryptographic hash function turns any amount of data into a fixed-length fingerprint. The same input always gives the same hash; any change, however small, gives a completely different one; and it is not feasible to work backwards from a hash to the input. Hashes are used to check file integrity, detect duplicates, sign API requests and, with special slow algorithms, to store passwords.
Choosing an algorithm
| Algorithm | Length | Status |
|---|---|---|
| MD5 | 128 bits | Broken for security: collisions can be created deliberately. Still fine for spotting accidental corruption. |
| SHA-1 | 160 bits | Deprecated for security since practical collisions were demonstrated in 2017. |
| SHA-256 | 256 bits | Current standard choice for integrity checks and signatures. |
| SHA-384 / SHA-512 | 384 / 512 bits | Stronger members of the SHA-2 family. |
SHA hashes and HMACs are computed with the Web Crypto API built into your browser. MD5 is not part of Web Crypto, so it is computed with a small JavaScript implementation of RFC 1321 included in this site.
Do not use these for storing passwords
General-purpose hashes like SHA-256 are designed to be fast, which helps attackers guess passwords at billions of attempts per second. Password storage needs a deliberately slow, salted algorithm such as Argon2, scrypt or bcrypt, provided by your programming framework.
Limitations to keep in mind
- Files are read fully into memory, so the limit is 500 MB and very large files may be slow on phones.
- Web Crypto requires a secure connection (HTTPS or localhost). On an insecure connection, SHA hashes are unavailable and the tool says so.
- HMAC-MD5 is not offered.
How your data is handled
Text, files and keys are processed in your browser and never uploaded or stored. Even so, avoid entering production secrets into any web page unless necessary.
Frequently asked questions
Can a hash be reversed to get the original text?
Not by computation. However, short or common inputs, such as simple passwords, can be found by looking them up in large tables of precomputed hashes, which is why hashes alone do not protect weak passwords.
Why does my hash differ from another tool’s?
Usually because of invisible differences in the input: a trailing line break, different line endings (Windows CRLF versus Unix LF) or a different text encoding. This tool hashes exactly what is in the box, as UTF-8.
How do I verify a downloaded file?
Switch to File, choose the download and paste the checksum from the publisher’s website into the comparison field. If it matches, the file is identical to the one the publisher hashed.