How it works

Get the SHA-256 fingerprint of any file. Same value you'd get from shasum -a 256 in a terminal.

Drop any file. The Web Crypto API computes SHA-256 in your browser, returning a 64-character hex digest. Useful for verifying a download matches the publisher's checksum, deduplicating files, or proving a file hasn't changed between two points. The same file produces the same hash everywhere: in this tool, in a terminal (shasum -a 256, openssl dgst -sha256, sha256sum), or in any SHA-256 library. The hash function is one-way, you can't recover the file from the hash. There's no file size limit; the algorithm streams over the file via crypto.subtle.digest. Copy the hash with one click and paste it where you need.

How to use it

1. Drop your file. Any file type and size works — hashing streams over the bytes locally.
2. Read the digest. The 64-character SHA-256 hex digest appears, identical to shasum -a 256 output.
3. Copy and compare. Copy the hash with one click and compare it to the publisher's checksum to verify the download.

Frequently asked questions

What hash algorithm does this use?

SHA-256 via the Web Crypto API. The output matches shasum -a 256, openssl dgst -sha256, and the sha256sum utility.

Is my file uploaded for hashing?

No. Web Crypto runs in the browser, the file's bytes never leave your device.

Can I verify a download checksum with this?

Yes. Compute SHA-256 here, compare to the value published by the source. If they match, the file is intact.

Why SHA-256 and not MD5?

MD5 is broken (collisions are easy). SHA-256 is the modern standard. For other algorithms applied to text, see Hash text.