Hash Checker (SHA-256)
Hash text or a file with SHA-256 and compare it against the expected value. Runs in your browser with no upload.
Loading the tool…
User reviews
No reviews yet. If you’ve used this tool, be the first to leave one.
Hash Checker (SHA-256): complete guide
Walk through the steps and examples, or jump straight to the topic you need.
At a glance
- Supported algorithms
- SHA-256, SHA-512, SHA-384, SHA-1. Only those the browser's standard hashing actually provides are included.
- Not supported
- MD5 and CRC32 are not in the browser's standard hashing, so they're not offered.
- Text basis
- Typed text is converted to UTF-8 bytes before hashing. The number of characters and the number of bytes can differ.
- File basis
- The file's bytes are hashed as they are. The same content gives the same value whether you enter it as text or as a file.
- Input limits
- 200,000 characters of text, or files up to 200MB.
- Progress and cancel
- Available only while the file is being read. The calculation after reading finishes in one step and can't be stopped midway.
- Comparison
- The expected value is cleaned of letter case, spaces, colons and 0x notation before comparing, and you are told if the length differs.
- Where it runs
- Both reading and calculation happen in this browser.
How to use Hash Checker (SHA-256)
Choose what to hash
Paste text or choose a single file. Empty input and empty files also produce a value normally. The example button lets you check right away that the tool works, using a widely known test value.
Choose the algorithm
Find out which algorithm the source of the expected value used and pick the same one. It is usually SHA-256. Use SHA-1 only to compare against an older value, never for security decisions.
Compute the hash
For files, progress is shown while reading and you can cancel. If you change the content or algorithm, the previous result is cleared, so press the button again.
Compare with the expected value
Paste the value from the publisher and it is compared automatically. Letter case and spaces are cleaned up, so you can copy straight from a table. If the length differs, the tool tells you which algorithm the value looks like.
What it’s good for
Check that a downloaded file is intact
Copy the SHA-256 value shown on the download page, paste it into the expected value field, and choose the file. Letter case, spaces and colons are cleaned up automatically, so you can copy straight from a table. If the values match, the file was not corrupted during download. If the length differs, the value may come from a different algorithm, and the tool tells you which algorithm it looks like.
A hash is neither encryption nor a signature
A hash is not encryption that locks content; it is a fingerprint that always gives the same value for the same content. You can't recover the original content from the value, and it doesn't prove who made it. If the place that gave you the expected value can't be trusted, a forged file and a forged value can arrive together, so check the value on the publisher's official channel. SHA-1 has publicly known cases of different content giving the same value, so it's best not to use it for security decisions.
Worked examples
A widely used test value
Input: abc
Algorithm: SHA-256ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adHash of empty input
Input: (empty)
Algorithm: SHA-256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855Choosing an algorithm
Swipe the table sideways to see the rest.
| Algorithm | Result length | When to use |
|---|---|---|
| SHA-256 | 64 characters | The most widely used. The default for verifying downloads. |
| SHA-512 · SHA-384 | 128 characters · 96 characters | Use when you need a longer value or the publisher provides that value. |
| SHA-1 | 40 characters | Use only to compare against older values. Never for security decisions. |
When the result isn’t what you expected
It says the length is different, though the value seems right
The expected value and the chosen algorithm don't match. 40 characters is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Switch to the algorithm named in the publisher's instructions and compute again.
Same file, different value
The file may have been corrupted during download, or you may have a different version. Download again and check; if it still differs, confirm the publisher's value is current. A file that was unpacked and repacked has a different value even if the content is the same.
It looks stuck on a large file
When reading finishes, progress stays at 100% for a moment. The whole file is being hashed in one go, and it can't be canceled at this point. Files near 200MB need spare memory on your device.
I need to check an MD5 value
This tool can't do that, because MD5 is not in the browser's standard hashing. Check whether the publisher also provides a SHA-256 value; if not, use your device's command-line tool.
Key terms
- Hash
- A fingerprint that turns content into a value of fixed length. The same content always gives the same value.
- Checksum
- A value you compare to confirm content hasn't changed. This tool uses hash values that way.
- Hexadecimal
- A way of writing values with 0-9 and a-f. Hash results are shown in this notation.
- Collision
- A case where different content has the same hash value. Real cases of SHA-1 have been published, so it isn't used for security.
Hash Checker (SHA-256) FAQ
Why is there no MD5?
Only algorithms provided by the browser's standard hashing (Web Crypto) are used. MD5 and CRC32 are not included there, so they're not supported. Supported are SHA-256, SHA-512, SHA-384 and SHA-1.
Can I hash large files?
Up to 200MB. The browser's standard hashing can't compute in pieces, so the whole file is loaded into memory and hashed in one go. That is why progress and cancel are available only while the file is being read.
Is my file uploaded?
No. Both reading the file and computing the hash happen inside this browser.
Can a hash lock a file?
No. A hash is a fingerprint, not encryption. You can't recover the original content from the value, and it doesn't hide the content either.
If the hashes match, is the file safe?
It only means the content is the same as what the publisher stated. If the source of the value can't be trusted, a forged file and a forged value can come together. Check the value on an official channel.
Can a hash tell me who made it?
No. Identifying the creator is the job of a digital signature, which is different from a hash.