SHA hash generator
Calculate SHA hashes of text in your browser. Compare algorithms and copy the digest you need.
Input is processed in your browser and is not sent to the server.
Verify a file’s SHA-256
Calculates the SHA-256 of a downloaded file and compares it with SHA256SUMS or a published hash. The file is not sent to the server; files up to 256 MB are supported.
Quick start
- Enter the source text.
- Check whitespace and line breaks.
- Copy the digest for the required algorithm.
Algorithms
| Algorithm | Use |
|---|---|
| SHA-256 / SHA-384 / SHA-512 | Compare digests with the expected algorithm and input bytes. |
| SHA-1 | Legacy compatibility only; not for collision-resistant security use. |
The same bytes produce the same digest
Spaces, line breaks, Unicode representation, and encoding affect input bytes. The tool encodes text as UTF-8 and uses the browser’s Web Crypto API.
MD5 is not exposed by this interface. The presence of SHA-1 does not make it suitable for security-sensitive applications.
Integrity is not authenticity
A digest comparison helps only if the expected digest comes from a trusted source. An attacker who can replace both the data and its digest can defeat this check.
A plain SHA digest is not password storage or encryption. Password systems need a suitable password hashing scheme and salt. Browser cryptographic APIs require a secure context such as HTTPS.
Verifying downloaded files
Text hashing calculates UTF-8 encoded text with Web Crypto, up to 1,000,000 characters. File verification reads files of up to 256 MB into browser memory and calculates SHA-256 only. Neither feature sends data to the server, and both require HTTPS or an allowed local secure context.
When a publisher provides SHA256SUMS or a hash, you can check that your download is identical to the file the list was made from. Paste the SHA256SUMS contents into the file verification and the line with the same file name is compared. Output from sha256sum, shasum, Get-FileHash and certutil is recognised, and the upper-case hashes Windows prints are treated as the same value.
PPORT update ZIPs also contain SHA256SUMS, and the update procedure installs only after sha256sum -c has checked every file. If the list and the file came from the same place, both could have been replaced together, so for important releases compare against a signed list or one obtained through a separate channel.
sha256sum -c SHA256SUMSshasum -a 256 release.zipGet-FileHash .\release.zip -Algorithm SHA256certutil -hashfile release.zip SHA256app.py: OK
static/js/site.js: FAILED
sha256sum: WARNING: 1 computed checksum did NOT matchsha256sum -c prints OK or FAILED for each line; if any file differs, it prints a warning at the end and exits with a non-zero status. Do not use a file marked FAILED; download it again.