What it does
It turns text into UTF-8 bytes, or reads the file you choose inside your browser, and calculates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once. Enter a key to also get the HMAC (RFC 2104) for the same five algorithms. Files are read in 4 MiB pieces and never uploaded.
“Copy as sha256sum” gives one <hash> <name> line (two spaces) — put it in a file such as SHA256SUMS and sha256sum -c reads it as is. For typed text the name is -, as for standard input.
Examples
| Input | Result |
|---|---|
hello → SHA-256 | 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 |
hello + final newline (echo hello) → SHA-256 | 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03 |
hello → SHA-256 Base64 | LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ= |
| empty text → MD5 | d41d8cd98f00b204e9800998ecf8427e |
a↵b LF / CRLF → SHA-256 | 7e18f737… / 18745f36… — one different line-break byte, a completely different hash |
The quick brown fox jumps over the lazy dog, key key → HMAC-SHA256 | f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 |
Checking a download
- Find the publisher's official checksum (often a
SHA256SUMSfile or a long hex string on the download page). - On the File tab, choose the downloaded file.
- Paste that file's line or hex string into “Check against an official checksum”. The algorithm is picked by length (64 characters = SHA-256) and the result says Same or Different. BSD-style
SHA256 (file) = …lines work too. If the length matches no algorithm, the tool does not guess and says it cannot check.
A checksum only shows the file is not corrupted; if you fetched the checksum from the same place as the file, it does not prove who published it. When the publisher also offers a signature (GPG etc.), check that too.
How it was checked
Before publishing it was compared with the real md5sum, sha1sum, sha256sum, sha384sum, sha512sum (GNU coreutils) and openssl dgst -hmac (OpenSSL 3.0), all matching: 40 texts (empty, Korean, emoji, CRLF/LF, final newline, block boundaries at 55/56/64/111/112/128 bytes, about 1 MiB) × 5 hashes, 5 Base64 forms and 5 HMACs (text key, Korean key, key longer than the block, hex key), and 10 files (0 bytes to 9 MiB, fed in different piece sizes) × 5 hashes, HMAC-SHA256, the exact sha256sum output line, and sha256sum -c reading that line back.
Common mistakes
- Comparing with
echo "abc" | sha256sum—echoadds a newline. Useprintf '%s' "abc"orecho -n, or turn on “Add a final newline” here. - Being surprised that a Windows text hashes differently from a Linux one — CRLF and LF are different bytes. Pick the line breaks to match.
- Storing passwords as MD5 or SHA-256 — fast hashes are not for passwords. Use a dedicated function such as Argon2, bcrypt or scrypt.
- Using MD5 or SHA-1 against tampering — practical collisions are known (RFC 6151, NIST SP 800-131A). Use them only to spot accidental corruption.
FAQ
Is my file uploaded?
No. The file is read with the browser's File API on this computer, and the scripts on this page do the math. Text, keys and file names are not written to the address bar or browser storage, and are not passed to this site's analytics or ads. Details are in the privacy notice.
Does it handle large files?
It reads 4 MiB at a time, so memory use stays small. Speed depends on the device; because five algorithms run together, multi-GB files can take minutes. For those, sha256sum file on the command line is faster.
How do I enter the HMAC key in hex?
Choose “key as hex” next to the key. The result equals openssl dgst -sha256 -mac HMAC -macopt hexkey:<hex>. A text key is used as its UTF-8 bytes, the same as openssl dgst -sha256 -hmac '<key>'.