How do I calculate the SHA-256 hash of a file?
Choose the text or drop the file and the tool returns its SHA-1, SHA-256, SHA-384 or SHA-512 fingerprint. Hashing uses the browser’s Web Crypto API in your own machine, so the file never leaves your device — which is the point: you can verify a download without handing its contents to a website.
Runs entirely in your browser · no upload · no account · no watermark
- Type or paste text, or drop in a file.
- Run the hash and read the four digests.
- Copy whichever fingerprint you need.
Used when no file is selected below. Nothing is sent anywhere.
A selected file replaces the text. Drop it on the box or choose one.
Drop a file here
Source: the text box.
| Algorithm | Digest (hex) | Copy |
|---|
What this page can do
- Hash pasted text or an entire file
- SHA-1, SHA-256, SHA-384 and SHA-512
- Copy the digest as hex
- Files are never uploaded
When to use this page
- Checking a download against a published SHA-256 checksum.
- Confirming two files or two blocks of text are byte-identical.
- Getting a digest without installing anything or uploading the file.
When to use something else
- You are hashing passwords — SHA family digests are fast, not password hashes; use Argon2id or bcrypt.
- You need HMAC, a digital signature, or MD5/CRC32/BLAKE3.
- You need to authenticate where the data came from; a hash only proves the bytes match.
How it compares with other options
sha256sum and similar tools stream arbitrarily large files with constant memory; here the file is read into the browser, so very large inputs are limited by device memory. Only SHA-1/256/384/512 are offered, and SHA-1 is no longer collision resistant — use it for casual comparison, not security. Verify authenticity with a public-key signature over the digest, not with the digest alone.
Where your files go
Nowhere. This page loads the code that does the work, and from then on the file you open is read by your own browser. There is no upload step, no temporary server copy and no cleanup to trust — the data never crosses the network, so there is nothing to delete afterwards. You can confirm it yourself: open your browser’s network panel while the tool runs and watch it stay quiet.
Questions about this tool
- Which algorithm should I use?
- Use SHA-256 for anything new: it is collision resistant and fast. SHA-384 and SHA-512 belong to the same family and give a longer digest when a standard or a policy asks for it. SHA-1 is offered only so you can match legacy checksums — it is no longer collision resistant and should never be used to prove that a file is authentic.
- Can I hash a very large file?
- Yes, up to the limit of your device’s memory, because the browser reads the whole file into an ArrayBuffer before digesting it. A few gigabytes is usually fine on a desktop; on a phone, keep to a few hundred megabytes. The file itself is never transmitted.
- Why is there no MD5?
- The Web Crypto API deliberately does not implement MD5, because it is broken and unsafe for any security purpose. Rather than ship a JavaScript MD5 that would run slowly on large files and tempt people into relying on it, this page sticks to the SHA family. If you have an old MD5 checksum to verify, you need a different tool.
Other tools in the same group
- QR code generatorTurn any text or URL into a downloadable PNG or SVG QR code.
- JSON formatterPretty-print, minify and validate JSON, with the error position when it is invalid.
- Base64 encoderEncode text or a file to Base64 and decode it back, including URL-safe variants.
- Regex testerTry a JavaScript regular expression against sample text, with matches and capture groups.
Guides
- How to check a download is genuine with a SHA-256 hashCompare a file’s fingerprint with the published checksum in your browser. The file never leaves your device — which is the point.
- Why these tools never upload your files, and how to checkThe difference between “we delete your file” and “your file was never sent” is the whole argument. Here is how to verify it yourself.