No. The file is read by your browser on your own device, in chunks, and hashed there. Nothing is sent to a server, which makes it safe for suspicious samples and confidential documents.

File hash calculator

Q: Why would I hash a suspicious file?

A hash identifies a file exactly. You can search a SHA-256 on threat intelligence services to see whether the file is known malware without uploading the file itself, which could alert the attacker or leak sensitive data.

Q: How do I verify a download?

Paste the hash published by the vendor into the 'Compare with a known hash' box, then add the file. The tool says which algorithm matched, or that none did.

Get the MD5, SHA-1, SHA-256 and SHA-512 hash of any file or text, and check it against a known hash. Files are hashed on your device and never uploaded.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

Drop files here, or choose filesAny size, up to 20 at a time. Files are read on your device and never uploaded.

Compare with a known hash (optional)

How it works

Drop one or more files and each is hashed with MD5, SHA-1, SHA-256 and SHA-512 at once. Large files are read in 4 MB pieces, so even multi-gigabyte disk images work without filling your memory, and you can follow the progress or cancel at any time.

Hashing runs in your browser using the audited, open-source noble-hashes library. The file never leaves your device. Switch to Text to hash a string exactly as typed, and paste an expected value to confirm a match. With several files, download all the hashes as a CSV.

Questions

Is my file uploaded?

No. Your browser reads the file on your own device, in chunks, and hashes it there. Nothing is sent to a server. That makes it safe for suspicious samples you must not share, and for confidential documents.

Why would I hash a suspicious file?

A hash identifies a file exactly. Searching its SHA-256 on threat intelligence services tells you whether the file is already known malware without uploading the file itself. Uploading a sample can tip off an attacker who watches those services, or expose sensitive content if the file is a real document.

Should I use MD5, SHA-1 or SHA-256?

Use SHA-256 to identify and verify files. MD5 and SHA-1 are broken for security purposes, because two different files can be crafted with the same hash, but many threat feeds, sandboxes and older tools still list them, so they are shown for lookups.

How do I verify a download?

Paste the hash the vendor publishes into “Compare with a known hash”, then add the file. The tool tells you which algorithm matched, or that none did. A mismatch means the file is corrupt or not the file the vendor published.