Local processing: This tool does not upload the text or file you select. Hash calculation happens in your browser.
What do you want to hash?

Text is encoded as UTF-8 before hashing.

SHA-256 is a common choice for published file checksums.

Paste the hexadecimal digest only. Spaces and colon separators are ignored.

2. Verify a checksum

A published checksum can help you confirm that the bytes you downloaded match the bytes used to create the published digest. Select the same algorithm used by the publisher, hash your local file, and compare the resulting hexadecimal value character for character. A matching checksum is useful evidence of file integrity, but the source of the expected checksum matters. If an attacker can replace both a file and the checksum displayed beside it, a match does not establish that the file is trustworthy.

3. Choose an algorithm

For new integrity checks, prefer a current function from the Secure Hash Algorithm 2 (SHA-2) family, such as SHA-256, SHA-384, or SHA-512. This tool includes SHA-1 because older files and documentation still use it, but the National Institute of Standards and Technology (NIST) is transitioning away from SHA-1 for cryptographic protection. The browser Web Cryptography API used by this page supports SHA-1, SHA-256, SHA-384, and SHA-512. Message Digest 5 (MD5) is intentionally not included because it is not provided by that API, and this tool does not ship its own cryptographic implementation.

4. What this proves

A cryptographic hash maps input data to a fixed-length digest. Small input changes should produce a different digest, which makes hashes useful for integrity checks and change detection. A hash by itself does **not** encrypt data, authenticate the source of a file, scan a file for malware, or prove that a download is safe. A plain fast hash is also not an appropriate password-storage scheme. Password storage uses purpose-built password hashing or key-derivation functions with salts and intentionally expensive work factors.

5. Privacy and large files

The text or file selected in this tool is passed directly to the browser's Web Cryptography API. The hash-tool code does not send that input to Cert Happens or a third-party hashing service. The browser must read a selected file into memory before calculating the digest. For very large files, an operating-system checksum command or another streaming-capable local tool may be more practical.

6. Official references

- [NIST Federal Information Processing Standard (FIPS) 180-4: Secure Hash Standard](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) - [NIST: Transitioning Away from SHA-1 for All Applications](https://www.nist.gov/news-events/news/2022/12/nist-transitioning-away-sha-1-all-applications) - [World Wide Web Consortium (W3C) Web Cryptography Level 2](https://www.w3.org/TR/webcrypto-2/)
Base64 and hex encoder/decoder Convert UTF-8 text, Base64, and hexadecimal locally in your browser. Hashing, encryption, and encoding quick reference Review the differences between hashing, encryption, and encoding. Security+ Domain 1 guide Review cryptographic concepts in the broader Security+ context. ISC2 CC Domain 5 guide Connect hashing with data protection and security operations concepts.