No. Hashing uses the browser's WebCrypto SubtleCrypto.digest API on the file's bytes locally. Nothing is transmitted.

Which algorithm should I use?

SHA-256 is the modern default for integrity and signing. SHA-512 is faster on 64-bit hardware. MD5 and SHA-1 remain useful for matching legacy checksums but are not collision-resistant.

Can I hash a multi-gigabyte file?

Yes — the file is streamed through the hasher rather than buffered fully, so size is limited only by the time you are willing to wait.

Why are MD5 and SHA-1 still included?

Many vendors still publish MD5 or SHA-1 checksums alongside their downloads. For verifying those, you need the same algorithm they used.

md5 · sha-1 · sha-256 · sha-512 · local

Hash any file with MD5 & SHA

Drop a file in to compute MD5, SHA-1, SHA-256, and SHA-512 digests using Web Crypto. Nothing leaves your browser — works on multi-megabyte files.

File Hash Generator

File

—

no file

Algorithms

md5 sha1 256 512

Engine

Web Crypto

+ js-md5

Status

—

local

input · file

Click to choose a file...

output · digests

Pick a file to hash

Quick Start

How to hash a file

Hashes prove a file hasn't been tampered with — a single byte change flips every output character. SHA-256 is the modern default.

01
Pick a file
Any size that fits in browser memory — multi-MB is fine.
Inputs are treated as UTF-8 throughout the pipeline and validated client-side as you type — nothing dispatches until the value is well-formed.
inpututf-8client-sidevalidated
file · textany · set
```
installer.iso
```
loaded · parsedclient-side
02
Crypto subtle digest
SHA-1/256/512 use Web Crypto; MD5 uses a tiny JS lib.
Each toggle re-computes through a memoised hook, so flipping options never resets your input and the UI stays snappy on large inputs.
engineoptionslivememoisedtoggles
engine · memoisedsubtle · live
```
crypto.subtle.digest
```
options set · memoisedlive
03
Verify or share
Compare against the publisher's posted hash.
Randomness — where used — comes from crypto.getRandomValues, never Math.random. Heavy work sits in useMemo.
verifycomputeinstantlocaldeterministic
hash · instantsha256 · computed
```
e3b0c44…
```
computed · instantinstant
04
Copy or download
Single click copies all four digests as a text block.
Copy writes through navigator.clipboard and downloads use a Blob — zero network traffic. Same input plus same options always yield the same bytes.
exportcopydownloadzero-networkreproducible
ok · copiedready · copied
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Pro tips for everyday utilities

Reach for crypto.getRandomValues

Cryptographically random for IDs, tokens, salts. Math.random is for animation and games, not security.

Sort IDs lexicographically

UUID v4 has no time ordering. Use ULID or UUID v7 if you need sorted IDs.

Mock data with seeds

Faker-style libraries can be seeded so tests are reproducible. Embed the seed in the fixture file.

Reference cards beat memory

Cheatsheets for Vim, Git, Docker, Linux signals are faster than man pages when you’re mid-flow.

Browser APIs vary

Touch events, gamepads, and clipboard differ across vendors. Feature-detect before use.

Persist in the right place

localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data.

Use Cases

When to hash a file

Integrity checks, downloads, deduplication.

Verify downloads

Match against publisher SHA-256 to catch corruption. Random values come from crypto.getRandomValues — cryptographically secure for tokens, salts, and session IDs. Math.random is deterministic enough for animations but predictable enough to be a security bug.

CSPRNG-backed

Content addressing

Use digests as keys in CAS/IPFS-style systems. Pair with hashids, ULID, or UUID v7 when you need both random and sortable — useful for primary keys, public-facing IDs, and event log ordering without a sequence column.

reproducible

Backup integrity

Confirm a restored file matches the original. Output is deterministic given the same seed, so fixtures and tests stay reproducible across CI runs and contributor machines. Embed the seed in the fixture file for full replay.

snappy

Build provenance

Pin artifact hashes in CI for supply-chain checks. Heavy work runs through useMemo so the UI stays snappy on large inputs. Same input + same options yields identical bytes — the kind of stability snapshot tests rely on.

feature-detected

Deduplication

Detect identical assets across folders. Storage tools persist to the right backend: localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data. Pick the right shelf and quota worries disappear.

deterministic

Forensics

Hash evidence files for chain-of-custody logs. Browser feature detection: clipboard, fullscreen, gamepad, and Web Bluetooth APIs gracefully fall back when unavailable. No surprise white screens on Safari or older Firefox.

production-ready

FAQ

Frequently asked questions

Why is MD5 still here?

It's broken for security but still common for integrity checks against vendor downloads. We include it for those workflows.

Should I use SHA-1?

Only when matching a legacy checksum. For new work prefer SHA-256.

How big a file can I hash?

Whatever fits into browser memory — typically several hundred MB without issues.

Where does MD5 come from?

We dynamically import js-md5 (Web Crypto doesn't expose MD5).

Is anything sent to a server?

No. The file never leaves your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!