data tool
SHA256 checksum online
A SHA-256 checksum is a 64 character fingerprint of a file: change a single byte and the fingerprint changes completely. Choose files or type text to get SHA-256, SHA-1 and SHA-512 hashes from the browser's own Web Crypto, and paste an expected hash to see at once whether they match.
Loading the tool…
- Runs on your device, nothing is uploaded
- Free, no sign in
- No watermark, no file limit
How it works
- 1
Choose files or text
Pick one file or several, or switch to text and type or paste.
- 2
Paste the expected hash
If the publisher lists a checksum, paste it in. Spaces and capitals do not matter.
- 3
Read the verdict
A green line says the hashes match; a red line says the file differs from the one the checksum was made from.
- 4
Copy a digest
Copy any of the three digests to record or send with the file.
What a checksum proves
SHA-256 is a hash function defined by NIST in FIPS 180-4. It turns any amount of data into a fixed 256 bit value, written as 64 hexadecimal characters. The same input always gives the same output, and finding two different inputs with the same output is, as far as anyone knows, not practical. So if the hash of the file you downloaded matches the hash the publisher printed, you have exactly the bytes they published: nothing corrupted in transit and nothing swapped along the way, provided the published hash itself came from a source you trust.
Why the hash may not match
A mismatch means the bytes differ. The usual causes are an incomplete download, a file that was edited or resaved since the hash was made, a different version of the file, or a checksum copied from the wrong line of a list. Line endings matter for text files: the same document saved on Windows and on a Mac can differ only in its line breaks and still give different hashes. If the publisher offers several algorithms, check that you compared SHA-256 with SHA-256, since the tool picks the algorithm from the length of the hash you paste.
Hashes and signed PDFs
A signed or certified PDF changes every time a signature is added, so its hash changes too. The certificate of completion from the e-sign module prints two hashes: the document as it was sent for signing, and the stamped file before it was certified. Neither of them equals the hash of the completed PDF you download, so do not compare them with this tool and expect a match. To check a signed PDF has not been altered, open it in a PDF reader that validates signatures; to show two copies of the completed PDF are identical, hash both here.
SHA-256 against SHA-1 and SHA-512
SHA-1 produces a 40 character hash and is no longer considered safe against deliberate tampering, since practical collisions have been demonstrated; it is shown here only because some older downloads still list it. SHA-512 produces a 128 character hash and is as strong as SHA-256 for this purpose. SHA-256 is the common choice for software downloads and document records. NIST's hash function pages describe the approved algorithms and their uses.
Keeping a record of a document
Recording a document's SHA-256 when you send or file it gives a simple way to show later that a copy is unchanged. Store the hash with the date and where the file went, for example in the notes of a contract register. Anyone with the original can recompute the hash and compare. Because the hash reveals nothing about the content, it can be shared or emailed even when the document itself is confidential.
Large files
Web Crypto hashes a whole buffer at once, so the file is read into memory first. Files of a few hundred megabytes are fine on most computers. A multi gigabyte disk image is better checked with a command line tool such as shasum or certutil, which read the file in pieces.
Limits
- MD5 is not offered: the browser's Web Crypto does not provide it, and it is no longer safe for checking integrity.
- Each file is read whole into memory, so the size limit is your device's memory.
- A hash proves two files are byte for byte identical. It does not prove who made or signed a file.
- Text is hashed exactly as typed, including spaces and line breaks, in UTF-8.
What it does not do
- It does not upload files or send hashes anywhere.
- It does not verify digital signatures inside a PDF.
- It does not store anything.
Questions people ask
How do I check a file's SHA-256 hash?
Choose the file here and copy the SHA-256 value, or paste the publisher's checksum into the expected hash box to compare automatically. On a computer you can also run shasum -a 256 on macOS or Linux, or certutil -hashfile with SHA256 on Windows, which give the same result.
Why does my hash not match?
The file differs from the one the hash was made from: an interrupted download, a newer or older version, a resaved copy, or a hash copied from the wrong line. Download the file again from the original source and compare once more. If it still differs, do not open it, and contact the publisher.
Does a matching hash prove who signed a PDF?
No. A hash proves two files contain identical bytes, nothing more. Who signed a PDF is shown by the digital signature inside it and its certificate, which a PDF reader can validate. Use a hash to show a copy is unchanged, and the signature panel to see who signed.
Is my file uploaded to calculate the hash?
No. The browser computes the hash on your own device using its built in Web Crypto, and no network request is made with the file. You can confirm it in the network tab of the developer tools. This matters when hashing contracts, payroll files or anything confidential.
Why is there no MD5 option?
The browser's Web Crypto interface does not offer MD5, and MD5 has been broken for years: different files with the same MD5 hash can be produced deliberately. If a publisher lists only MD5, ask for a SHA-256 checksum, which is what most software publishers now provide.
Send a document for certified signing
Take what you made here into e-signatures.
Send a document for signingMore tools like this
- Sign a PDFDraw, type or photograph your signature, place it on any page and download the signed file. Runs in your browser. A drawn mark, not a certificate.
- PDF metadata viewerA PDF metadata viewer that shows title, author, subject, keywords, creator, producer, dates, page count, version, encryption and page sizes, on your device.
- Compare two PDFsCompare two PDFs in your browser: the text of both is diffed word by word, with page numbers and both pages side by side. Nothing is uploaded.
- UUID generatorA UUID generator for version 4 random ids and version 7 time ordered ids, up to 1,000 at once, made with the browser's crypto source. Copy all or download.
- Extract images from a PDFExtract images from a PDF in your browser: every picture as a PNG with its page and pixel size, plus stored JPEGs byte for byte, one by one or as a zip.
Background reading: the question page on this.
Written and checked by the OneCraft team. Last checked .