What is a hash?
A hash, or digital fingerprint, is a fixed-length value computed from any data by a one-way mathematical function. Every text or file has a unique fingerprint, and changing even one character changes it completely. Hashes can't be reversed to recover the original data, which is why they're used to verify files, store passwords safely, sign documents and power blockchains.
Supported algorithms
| Algorithm | Length | Use |
|---|---|---|
| MD5 | 128-bit | Integrity checks only; no longer secure |
| SHA-1 | 160-bit | Legacy systems and Git; not recommended for security |
| SHA-256 | 256-bit | Today's standard: certificates, Bitcoin, download verification |
| SHA-384 / SHA-512 | 384 / 512-bit | Higher security margins |
How to verify a download
- Copy the official SHA-256 value from the software's website (usually next to the download link).
- Open the “File” tab and drop the file you downloaded.
- Paste the official value into the compare field.
- “Match” means the file is intact and unmodified; otherwise don't open it and re-download from the official source.
A note on password storage
Never store user passwords with plain MD5 or SHA-256 — they're fast and easily brute-forced or looked up in rainbow tables. Use password-hashing algorithms such as bcrypt, Argon2 or scrypt with a unique random salt per user.
🔒 Hashes are computed in your browser via the Web Crypto API, so your files and text are never uploaded — even large files.
Practical uses for hashes
- Verify downloads: many sites publish SHA-256 checksums. Hash the file after downloading and compare — if they match, the file is intact and unmodified.
- Find duplicate files: two files with the same hash have identical content, even with different names.
- Prove documents weren't changed: save a contract's or report's hash and check it later.
Which algorithm?
MD5 and SHA-1 are fast, but it's been shown that two different files can share the same hash, so they're unsuitable for security — fine only for catching accidental corruption. SHA-256 and SHA-512 are the current secure standard.
A warning about passwords
Don't store passwords as plain SHA-256 hashes in your apps: these algorithms are so fast that guessing is easy. Use purpose-built algorithms like bcrypt or Argon2. To create strong passwords, use the Password Generator.
Frequently Asked Questions
Can a hash be reversed?
No — hashing is one-way. Short common strings can be guessed by checking known databases, though.
Why is MD5 no longer secure?
Two different files can be crafted with the same MD5 (a collision), so it's only used to catch accidental errors.
Is a hash case-sensitive?
“ABC” and “abc” produce completely different hashes. Displaying a hash in upper or lower case doesn't change its value.
Can I hash large files?
Yes, files up to several hundred megabytes usually work, depending on your device memory.
Is the file uploaded?
No. Everything is computed locally in your browser.
Last updated: