What a file hash is
A hash, or checksum, is a fixed length fingerprint calculated from every byte of a file. Feed the same file through the same algorithm and you get the same digest every time; change even a single byte and the digest changes completely. That makes hashes the standard way to prove that two copies of a file are identical without comparing them byte by byte.
The digest is shown as hexadecimal, where each character carries four bits. That is why the digests have the lengths they do: the algorithm name tells you the number of bits, and dividing by four gives the number of characters.
Verifying a download
The classic use is checking that a download arrived intact and untampered. Many software projects publish the expected checksum next to the download link, usually SHA-256. Download the file, drop it into the tool, paste the published hash into the expected hash field, and the verdict tells you instantly whether your copy matches. A match means the bytes on your disk are exactly the bytes the publisher hashed, so nothing was corrupted on the way and nobody swapped the file in transit.
Two habits make this genuinely useful. First, always take the expected hash from the official project site, not from the same mirror that served the file; a tampered mirror can lie about both. Second, check the algorithm matches. If the site publishes a 40 character hash it is SHA-1, and you need the SHA-1 setting for the comparison to make sense. The tool spots length mismatches and suggests the right algorithm.
SHA-256, SHA-1 and SHA-512 compared
SHA-256 is the current workhorse, used everywhere from software distribution to certificate signatures, and it is the default here. SHA-512 is its bigger sibling from the same family, equally trusted, with a digest twice as long. SHA-1 is different: researchers have demonstrated practical collisions, meaning two different files can be crafted to share a SHA-1 digest, so it should not be relied on against a determined attacker. It remains useful for spotting accidental corruption, and it is included because plenty of older download pages still publish SHA-1 sums.
For an honest sense of the strength involved, consider how many possible SHA-256 digests exist. The space is so large that the chance of two different files colliding by accident is negligible for any realistic number of files.
MD5 is deliberately absent. It has been broken for far longer than SHA-1 and offering it would suggest a level of protection it cannot provide.
Hashed on your device, never uploaded
The whole calculation happens in your browser using the WebCrypto engine built into it. The file is read from disk into memory, hashed locally, and the digest is displayed. Nothing is transmitted, logged or stored, so the tool is safe for private documents, installers and anything else you would rather keep to yourself. Close the tab and every trace is gone.
Because the file is held in memory while it is hashed, very large files are the one practical limit. Hundreds of megabytes are fine on any modern machine; multi-gigabyte disc images may be slow or run out of memory on low powered devices. If you just want to hash a snippet of text rather than a file, the hash generator does the same job for typed input.
Frequently asked questions
Is my file uploaded anywhere?
No. The file is read and hashed by JavaScript running on your own device, using the browser's built-in WebCrypto engine. Nothing travels over the internet, nothing is logged or stored, and closing the tab removes everything.
Which algorithm should I choose?
Use whichever one the download page published. If you have a choice, SHA-256 is the modern standard and the default here. SHA-512 is equally strong with a longer digest, while SHA-1 is offered only because many older sites still publish SHA-1 sums.
What does a matching hash actually prove?
It proves the file on your device is byte for byte identical to the file the publisher hashed. That rules out corrupted downloads and tampering in transit. It does not prove the publisher is trustworthy, so always take the expected hash from the official site.
Why is MD5 not included?
MD5 has been cryptographically broken for years, and attackers can create two different files with the same MD5 sum. Offering it would encourage a false sense of security. If a site only publishes an MD5 sum, treat it as a basic corruption check at best.
Can it handle very large files?
Yes, within reason. The whole file is read into memory before hashing, so files of a few hundred megabytes are fine, but multi-gigabyte files may be slow or fail depending on your device's memory. There is no size limit imposed by the tool itself.