Hash Calculator

How do you calculate a text or file hash?

Select Text, type a string into Text Input, and pause to see six checksums. For a file checksum, select File and choose or drop the file. No Calculate button is required. Text hashing waits 300 ms after an edit; file hashing starts when a file is selected. Use Hex or Base64 to choose the result encoding, then Copy beside the algorithm you need.

For a reproducible example, enter hello in Text mode with no spaces or newline. The details show 5 UTF-8 bytes and line endings of none. In Hex mode, the SHA-256 result is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. A file containing exactly those five bytes produces the same result. A text editor that saves an extra newline creates a different byte sequence, so its file checksum differs even though the visible word looks identical.

What are cryptographic hashes, and which checksum should you use?

A hash maps input bytes to a fixed-length digest. The same bytes and algorithm produce the same result, regardless of the filename. Hashing is not encryption: there is no decryption key or reverse operation here. Cryptographic hashes aim to resist finding an input from its digest or finding two inputs with the same digest. Not every checksum offered here provides those security properties.

SHA-256, SHA-384 and SHA-512 belong to the SHA-2 family defined in NIST FIPS 180-4. MD5 and SHA-1 have known collision weaknesses; CRC32 is an error-detection checksum rather than a cryptographic hash. Use legacy algorithms when an existing reference requires them, and a modern cryptographic hash for a new security-sensitive integrity workflow. None of these plain digests replaces a dedicated password storage scheme.

Checksum output lengths in Hex mode

Algorithm	Digest bytes	Hex characters	Role
MD5	16	32	Legacy compatibility
SHA-1	20	40	Legacy compatibility
SHA-256	32	64	Cryptographic integrity checks
SHA-384	48	96	Cryptographic integrity checks and SRI
SHA-512	64	128	Cryptographic integrity checks and SRI
CRC32	4	8	Accidental error detection

Why do apparently identical strings produce different hashes?

The calculator hashes the UTF-8 encoding of the current text value without trimming it. Leading spaces, trailing spaces and line breaks all count. A field containing one space is valid input. A completely empty text field deliberately shows no computed result, although selecting a zero-byte file does calculate its defined checksums. Do not add a space merely to make an empty input produce output: that hashes a different message.

Text details report the encoded byte count, not a character count. For example, é occupies two UTF-8 bytes. The line-ending indicator distinguishes LF, CRLF, CR, mixed and none. It describes the current text field value; when checking an existing file, use File mode to preserve its actual bytes rather than relying on how pasted text is represented.

The invisible-character warning flags selected zero-width characters, nonbreaking spaces as NBSP, and the byte order mark as BOM. It is a diagnostic aid, not an exhaustive Unicode inspector. There is no encoding selector or control to normalize whitespace. If a digest differs from a reference, check the source encoding, final newline and hidden characters before assuming the hash algorithm is wrong.

How do Hex, Base64 and SRI outputs differ?

Hex and Base64 represent the same digest bytes using different alphabets. Hex displays lowercase hexadecimal characters; Base64 converts the raw digest bytes, not the visible hexadecimal text. Changing the output tab changes how results are displayed. It does not change the input or algorithm. For general encoding tasks, use Base64 Encode Decode rather than treating a Base64 checksum as an encoded copy of the source.

The SHA-384 and SHA-512 rows additionally show SRI and Copy SRI. These produce the algorithm prefix followed by the Base64 digest, in the form sha384-[digest] or sha512-[digest]. Under the Subresource Integrity standard, that value belongs in an integrity attribute for a script or stylesheet. Hash the exact resource bytes you will deploy; changing whitespace or minifying afterward changes the digest.

SRI output remains Base64 when the main output tab is Hex. This page does not provide a dedicated SHA-256 SRI control, generate a complete HTML tag, or fetch a remote resource. Select a local copy of the resource and copy the supplied integrity value into your markup yourself.

How do you verify a downloaded file?

Obtain the expected checksum from a source you trust, select the downloaded file, and compare the matching algorithm row in the matching encoding. Compare the complete digest, not just its beginning or end. There is no expected-hash input or automatic pass/fail comparison on this page. The regular Copy control copies only the displayed digest; Copy SRI includes the algorithm prefix.

A matching cryptographic digest supports an integrity check against that reference. It does not by itself identify the author, scan for malware or prove that the reference is genuine. If both a download and its reference checksum are replaced, comparing them cannot establish authenticity. A different digest means the bytes or selected algorithm differ; first check that you selected the intended file and reference.

How does local hashing work, and what limits apply?

The page encodes text with TextEncoder and reads a selected file with File.arrayBuffer(). The four SHA algorithms call the browser's Web Crypto API through SubtleCrypto.digest(). MD5 and CRC32 use local implementations, with input processed in 4 MiB slices. The file is still read into memory in full first: this page does not stream a file from disk or offer a batch queue.

The input accepts any file type up to 500 MiB, exactly 524,288,000 bytes. Files above that ceiling are rejected. Available memory and device speed still matter below the limit, especially because six algorithms are requested together. The calculation path does not upload file contents. Results are held in page state, and a read failure shows an error rather than a checksum.

Editing input clears previous results, and a run guard prevents an older calculation from replacing a newer one. Switching between Text and File also clears the current text and selected file. Copy needed digests before changing modes. For other local utilities, explore Developer Tools; use JSON Formatter before hashing only if you intentionally want to hash the reformatted text.