How to generate a hash or verify a checksum
- Choose Text and type or paste your input, or choose File and drop a file onto the box.
- SHA-1, SHA-256, SHA-384 and SHA-512 are calculated at once. Toggle Uppercase if you need capital hex letters.
- Press Copy next to the algorithm you need.
- To verify a download, paste the publisher's checksum into the compare field. A green match confirms the file is byte-for-byte identical to what they hashed.
How cryptographic hashes work
A hash function turns input of any size into a fixed-length fingerprint. SHA-256 always produces 256 bits, shown as 64 hexadecimal characters. The same input always gives the same output, while changing a single bit produces a completely different hash. A secure hash is also one-way: you cannot recover the input from the output, and finding two inputs with the same hash should be infeasible.
SHA-1 and the SHA-2 family (SHA-256, SHA-384, SHA-512) are specified by NIST in FIPS 180-4. SHA-1 is no longer collision-resistant, since researchers produced a real SHA-1 collision in 2017, so it is listed here only for legacy systems such as older Git object IDs.
Algorithm reference
| Algorithm | Output | Hex length | Status |
|---|---|---|---|
| SHA-1 | 160 bits | 40 | Legacy only; collisions demonstrated |
| SHA-256 | 256 bits | 64 | Recommended default |
| SHA-384 | 384 bits | 96 | Secure; common in TLS and Subresource Integrity |
| SHA-512 | 512 bits | 128 | Secure; can be faster than SHA-256 in software on 64-bit CPUs |
Tip: the length of a published checksum tells you its algorithm. 64 hex characters means SHA-256, 128 means SHA-512, and 32 usually means MD5. Very large files are loaded fully into memory before hashing, so on a phone it is better to verify multi-gigabyte files with a command-line tool such as sha256sum or certutil -hashfile file SHA256.