What a hash is
A hash function turns any amount of data into a short, fixed-length fingerprint. Four properties make hashes useful:
- Same input, same hash. Hash the same file twice, on any computer, and you get the same value.
- Fixed size. SHA-256 always gives 256 bits (64 hex characters), whether you hash one letter or a 4 GB video.
- Tiny change, totally different hash. Change one byte and about half the output bits flip.
- One way. You cannot work backwards from a hash to the original data.
For example, the SHA-256 of abc is ba7816bf8f01cfea…f20015ad. Add a newline to the end and the SHA-256 becomes edeaaff3f1774ad2…0efd18cb. Nothing in the second hash hints that the inputs were almost identical.
Which algorithm should you use?
| Algorithm | Hex characters | Bits | Good for |
|---|---|---|---|
| MD5 | 32 | 128 | Old checksums and cache keys, not security |
| SHA-1 | 40 | 160 | Legacy systems such as older Git repositories, not security |
| SHA-256 | 64 | 256 | Download checksums, signatures, general use |
| SHA-384 | 96 | 384 | Subresource Integrity, certificates |
| SHA-512 | 128 | 512 | Same uses as SHA-256, with a longer output |
| SHA3-256 | 64 | 256 | The newer SHA-3 standard, built on a different design |
| CRC32 | 8 | 32 | Spotting accidental errors in ZIP files, PNG images and network data |
If a website does not say which algorithm it used, count the characters. A 64-character hex value is almost always SHA-256. The tool does this for you when a pasted hash does not match.
MD5 and SHA-1 are broken for security. Researchers can create two different files with the same MD5 hash, and in 2017 the same was shown for SHA-1. They still catch random corruption, but an attacker can fool them. CRC32 is weaker again: it was designed to catch transmission errors, not tampering.
How to verify a download
Software publishers often list a checksum next to the download link. Checking it takes a few seconds:
- Copy the SHA-256 value from the official download page.
- Switch to File and drop the downloaded file onto the tool.
- Paste the value into Expected hash.
- Look for Match: SHA-256. If there is no match, download the file again: it is either damaged or not the file the publisher released.
A checksum is only as trustworthy as the page you copied it from. If an attacker can change the download, they may also be able to change the checksum on the same page, so take it from the publisher’s official site over HTTPS.
Large files are read in 8 MB chunks by a background worker, so the page stays responsive and even multi-gigabyte disk images work. Speed depends on your device, and choosing fewer algorithms makes it faster.
Why two tools give different hashes
When your hash does not match someone else’s, the input is almost always different, not the maths:
- A hidden newline.
echo "abc" | sha256sumhashesabcplus a newline, which givesedeaaff3…, notba7816bf…. Useprintforecho -ninstead. - Line endings. Windows ends lines with two characters (CR and LF), while macOS and Linux use one. The same visible text gives different hashes.
- Text encoding. This tool hashes text as UTF-8, the web standard. A program that uses another encoding gets different bytes for letters such as é.
- Formatting is not a difference. Uppercase and lowercase hex are the same value. Base64 is simply another way to write the same bytes, so the compare box accepts both.
Need to find where two texts differ? Paste them into text compare.
HMAC: a hash with a secret key
A plain hash proves that data has not changed, but anyone can calculate it. HMAC mixes in a secret key, so only someone who knows the key can produce the right value:
Here H is the hash function, m is the message and opad and ipad are fixed padding values. For example, HMAC-SHA-256 with the key key and the message “The quick brown fox jumps over the lazy dog” is f7bc83f430538424…2d1a3cd8.
Payment providers, GitHub and many other services sign webhooks this way. The sender hashes the message body with a shared secret, and your server repeats the calculation to check the signature. Always hash the exact raw body you received: reformatted JSON gives a different result.
Do not store passwords with these hashes
MD5, SHA-1 and SHA-256 are designed to be fast, and fast is the wrong property for passwords. A single modern graphics card can test billions of SHA-256 guesses per second. Password storage needs slow, salted algorithms such as Argon2, bcrypt or scrypt. If you need a strong password or HMAC secret in the first place, create one with the password generator.
Privacy
Everything runs in your browser. Text, files and keys are never uploaded, so it is safe to hash private documents or check webhook signatures with real secrets. To move binary data around as text, use the Base64 encoder.