What a hash is, in one minute
A hash function converts any input — a word, a novel, a 4 GB file — into a fixed-length fingerprint. The same input always yields the same fingerprint; change a single byte and the fingerprint changes completely. That property makes hashes the standard way to verify integrity: if your downloaded file's SHA-256 matches the one the publisher lists, you have the exact file they published, untouched by corruption or tampering.
How to use it
- Type or paste text — SHA-1, SHA-256, SHA-384 and SHA-512 update live.
- Or drop in a file to compute its checksums (done locally by your browser's crypto engine — the file goes nowhere).
- Copy any hash with its button, or compare against a published checksum character by character — any difference at all means a different file.
Good to know
- Use SHA-256 by default. It's the modern standard for checksums, certificates and blockchains alike.
- Where's MD5? Deliberately absent: MD5 is cryptographically broken (collisions are cheap to make) and browsers don't ship it. Old tutorials mentioning MD5 checksums should be read as "use SHA-256 now."
- SHA-1 is included for legacy comparison only — plenty of older published checksums use it — but don't choose it for anything new.
- Hashes aren't encryption: they can't be "decrypted," only compared. And plain hashes are not the right way to store passwords — that job needs specialized slow algorithms like bcrypt or Argon2.
Frequently asked questions
Which hash algorithm should I use?
SHA-256 for almost everything — it's the modern standard for file checksums and integrity verification. SHA-512 where longer output is specified; SHA-1 only to compare against old published checksums.
Why is there no MD5 option?
MD5 is cryptographically broken — collisions can be manufactured cheaply — and browsers' built-in crypto deliberately excludes it. Anywhere an old guide says MD5, SHA-256 is the current answer.
Is my file uploaded to compute its hash?
No — hashing runs in your browser via the Web Crypto API. Even multi-hundred-megabyte files are processed locally, which is why it works with your internet disconnected.
Can I 'decrypt' a hash back to the original?
No — hashing is one-way by design. A hash can only be compared against the hash of a candidate input. (That's also why plain hashes are the wrong way to store passwords; that job needs bcrypt/Argon2.)