Hash a file without uploading it
You can compute a checksum locally with CRC32, MD5, SHA-1, the SHA-2 family, SHA-3 or Keccak-256. A hash proves that two copies of a file are identical; it says nothing whatsoever about keeping the file confidential.
At a glance
- Tool
- /tools/hash-generator
- Algorithms
- CRC32, MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256
- HMAC
- With SHA-1, SHA-256, SHA-384 or SHA-512
- Input
- Text or a file
- Warning threshold
- Files above 256 MB
- What a hash proves
- Integrity. Never confidentiality
In detail
Checking a download against a published checksum is a security step, and performing that security step by uploading the file to a stranger defeats it completely. The reason a publisher gives you a checksum in the first place is so that you can confirm the bytes independently of any intermediary, including them.
Match the algorithm to the one that was published. If the publisher gave a SHA-256 value, compute SHA-256; a matching value from a different algorithm proves nothing about their claim. MD5 and SHA-1 still appear on older projects and remain fine for catching an accidentally corrupted download, but neither should be trusted where somebody might have substituted a file deliberately.
The 256 MB warning is the honest consequence of doing this on your own machine. Hashing reads the entire file through your own memory, so a very large archive is slow and can fail where a server with more room would not. Above that threshold, expect it to take a while, and close other heavy tabs before you start.
This is the best page in the cluster for the offline test, because the result is self-proving. Disconnect the network, hash the file, and compare the value against the checksum the publisher printed on their site. A matching value computed with no network could not have come from anywhere but your own machine.
Examples
Published by the project: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
Computed here (SHA-256): 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
Compare the whole string, not the first and last few characters.
Take the published value from a different place than the download where you can.Things that catch people out
- A hash is not a secret keeper. Hashing a short or predictable value protects nothing, because candidates can simply be hashed and compared.
- Compare the entire digest. Matching the first and last few characters is how a substituted file gets accepted.
- A checksum published next to a compromised download can be edited too. Get the expected value from an independent source when it matters.
Try it: Hash Generator
The file hasher is on every page here because it takes any file at all and proves the point: disconnect from the network, drop a file in, and it still returns a checksum you can compare against a published one.
Hash Generator
LOCAL · Browser-OnlyGenerate MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, Keccak-256, CRC32, and HMAC hashes from text or files
MD5 is cryptographically broken and should not be used for security purposes. Use SHA-256 or SHA-512 instead.
Related Working without uploading
All working without uploading →View a file as a hex dump without uploading it
Inspect any file's raw bytes in your browser. If you cannot identify a file, uploading it to find out is the wrong first move.
Encrypt text in your browser without uploading it
AES encryption that runs locally, so the plaintext and the passphrase both stay put. What that protects, and what it cannot protect.
Sign a PDF in your browser without uploading it
Draw, type or place a signature on a PDF locally. Why a visual signature is not a cryptographic one, and when that difference matters.
Decode a JWT without sending it to a website
Read and verify a token in your browser. A JWT is a live credential: pasting one into a hosted decoder hands over a working session.
Check a .env file without uploading your secrets
Find duplicate keys, mask values and generate a .env.example locally. A .env is nothing but credentials, so uploading one means rotating them.
Base64 encode a file without uploading it
Encode files or text in your browser, with a URL-safe variant and line wrapping. Base64 is a transport encoding, never encryption.
Tools for this
- Hash Generator Free online hash generator - generate MD5, SHA-1, SHA-256 hashes from any input text
- Hex Dump Viewer View hex dumps of files and text online - color-coded bytes, search, and ASCII representation
- AES Encryption Tool Free online AES encryption tool - encrypt and decrypt text using AES-256 encryption