File Hash Checker Free — SHA-256, MD5, SHA-1
Did that download arrive whole, or was it damaged — or tampered with — on the way? A file hash answers that question in seconds. This free file hash checker calculates the SHA-256, SHA-1 and MD5 fingerprints of any file you choose, right in your browser, and shows them beside copy buttons so you can compare them with the checksum published by the file’s author. Matching hashes mean the file is byte-for-byte identical to the original; different hashes mean something changed. SHA-256 and SHA-1 use your browser’s built-in WebCrypto and MD5 a small script on this page — no server, no upload, no sign-up, nothing stored. You can also hash a short piece of text instead of a file, handy for checking the test vectors below.
Warning: Do not paste production secrets, passwords or private keys into any online tool — including this one. Hashing is done locally, but treat any pasted secret as exposed.
Any file type. It is hashed in your browser and never uploaded.
Or Hash Some Text
Privacy: your file and text never leave your browser. Hashing runs entirely on your device.
How to Use
- Choose a file. Click the drop zone and select any file, or drag it straight into the box. The file is read on your device only; its name and size are shown, and nothing is uploaded.
- Wait for the three hashes. The tool calculates SHA-256, SHA-1 and MD5 in a few seconds, even for large files. SHA-256 is the one to compare first, because it is the checksum most download pages publish.
- Compare with the published checksum. Find the hash on the download page, copy the matching hash from this page with its Copy button, and compare them character by character. An exact match means the file is identical to the original.
- Hash text instead, if you need to. Type or paste text into the lower box and click Hash Text to get the same three hashes for that exact text — useful for testing, or for checking a short string against a known value.
Worked Example
Hashing is easiest to verify with a word everyone can test: hello. Type exactly hello — five lower-case letters, no spaces, no line break — into the text box and click Hash Text, or save a file containing exactly those five letters and hash the file. The three hashes are:
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
SHA-1: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d
MD5: 5d41402abc4b2a76b9719d911017c592
These are the well-known standard test vectors for the string “hello”, so if this page shows them, the tool is working correctly. A common trap is the empty string: hashing nothing gives SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, the hash of zero bytes — so if you see it, your file was empty or the text box blank. Another trap is an invisible newline: most editors add one at the end of a file, and hello plus a newline hashes differently, so always compare against a hash of the exact same bytes.
Why Hashes Prove a File Is Unchanged
A hash function squeezes any amount of data into a short fixed-length string, practically one-way: you cannot reconstruct the file from the hash, and no different file shares the same hash by accident. Even one changed byte produces a completely different hash, which is why checksums are how software authors prove a download is genuine. SHA-256 is the algorithm to trust today: it is what download pages, package managers and operating systems publish. MD5 and SHA-1 are here because older pages still publish them, but both have known weaknesses, and a matching MD5 alone no longer proves a file is safe — always prefer SHA-256, and treat a mismatching hash as a reason to stop.
Tips for Checking Downloads
Get the expected hash from the author’s own website, never from the same place you downloaded the file — a compromised mirror can fake both. Compare the full hash, not just the first few characters; two different files can share a short prefix, and all 64 characters of a SHA-256 hash must match. Hash the file before you open or install it, especially installers, disk images and firmware, where a damaged file can do real harm. Keep the hash with any file you archive, so you can later prove the copy is still the original. A matching hash proves the file is unchanged since the author hashed it — not that the author is trustworthy, so only download from sources you trust.
Frequently Asked Questions
What is a file hash?
A file hash is a fixed-length fingerprint calculated from a file's exact contents. Change even one byte and the hash changes completely. Comparing the hash of a downloaded file with the hash published by its author proves the file arrived whole and unaltered.
Which hash should I use: SHA-256, SHA-1 or MD5?
Use SHA-256 whenever you have the choice — it is the current standard and the one most download pages publish. SHA-1 and MD5 are shown here for older checksums and legacy files, but both are considered weak for security purposes and should not be relied on alone.
Is my file uploaded to a server?
No. Your file never leaves your browser. SHA-256 and SHA-1 are calculated with your browser's built-in WebCrypto, and MD5 is calculated by a small script on this page. Nothing is uploaded, stored or seen by anyone else.
Why does my hash not match the one on the download page?
A different hash almost always means a different file. Check that you downloaded the exact file and version the hash belongs to, and that the download finished — an interrupted download produces a different hash. If the file is correct and complete and the hash still differs, do not trust the file.
Can I hash text instead of a file?
Yes. Type or paste text into the Hash some text box and click Hash Text to get the same three hashes for that exact text. Never paste production secrets, passwords or private keys into any online tool, including this one — hashing is done locally, but treat any pasted secret as exposed.