Is CRC32 cryptographically secure?

No. CRC32 is a linear checksum designed to detect random bit errors. It's trivial to construct two inputs with the same CRC, so never use it for tamper detection — use SHA-256 or BLAKE3 instead.

What's the difference between CRC32 and CRC32C?

They use different polynomials. CRC32 (IEEE 802.3) is the variant used by ZIP, gzip, Ethernet, and PNG. CRC32C (Castagnoli) has better error-detection properties and is used by iSCSI, ext4, and Btrfs, and has hardware acceleration via SSE 4.2.

Where is the checksum calculated?

In your browser. No input leaves the page.

crc32 · ieee · 8 hex chars · live

Compute CRC32 checksums

Calculate the IEEE 802.3 CRC32 checksum used by ZIP, PNG, Ethernet, and gzip. 32-bit, 8 hex characters. Runs entirely in your browser.

CRC32 Generator

Input

43 B

43 chars

Algorithm

CRC32

32-bit IEEE

Hex

414fa339

lower

Decimal

1,095,738,169

unsigned

input · text

output · crc32

hex: 414fa339
dec: 1095738169

Quick Start

How CRC32 works

Polynomial division over GF(2) with the IEEE 802.3 polynomial 0xedb88320 (reflected). Output is a 32-bit unsigned integer shown in hex and decimal.

01
Type or paste text
UTF-8 bytes are fed into the lookup-table-driven loop.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
inputUTF-8TextEncoderlosslesslive
input · raw bytestext · UTF-8
```
hello
```
loaded · UTF-8MIME · ready
02
Lookup table
256-entry table for the IEEE reflected polynomial.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
implWeb Cryptosubtledeterministiclive
poly · options0xedb88320 · live
```
reflected
```
options applied · livelive
03
Read the digest
32-bit output shown as 8 hex chars and an unsigned decimal.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
outmemoisedoptionsinstantreactive
out · encoded32-bit · ready
```
414fa339
```
encoded · livelossless
04
Copy or download
Copy the hex digest or download hex + decimal as .txt.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to use CRC32

Non-cryptographic, accidental-corruption detection.

ZIP / gzip

Each entry stores a CRC32 trailer for integrity. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

PNG chunks

Each PNG chunk ends with a CRC32 of its contents. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Ethernet frames

Layer-2 frame check sequence is a CRC32. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Quick fingerprints

Cheap deterministic IDs for cache buckets. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Test fixtures

Snapshot deterministic outputs in tests. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Embedded systems

Small footprint — fits MCUs without crypto blocks. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

Is CRC32 a cryptographic hash?

No. CRC32 detects accidental bit-flips; collisions are trivially constructed by anyone. Use SHA-256 or BLAKE3 for adversarial integrity.

Why is the hex always 8 characters?

CRC32 is a 32-bit value = 4 bytes = 8 hex characters.

Is this CRC32C (Castagnoli)?

No, this is the IEEE 802.3 variant used by ZIP, gzip, and Ethernet. CRC32C uses a different polynomial.

Can I checksum a file?

For files use the File Checksum Verifier — it streams large files efficiently.

Is anything sent to a server?

No. CRC32 is computed in your browser with a built-in table and runs locally.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!