File SHA-256

Processed in this browser

File limit: 64 MB

This tool never uploads your input.

Drop one file to hash it locally

Drop a file here or choose one.

Sample workflow: choose a supported file on this device, then process it. The file stays in this tab.

Compute SHA-256 for one file in this tab so you can compare it to the checksum on the vendor’s site. A match means the bytes match — not that the publisher is honest, and not that the file is malware-free.

The download page printed a SHA-256 and you want to know if the installer matches. Uploading the installer to a “checksum website” is backwards. This page hashes one file, SHA-256 only, in a worker on this device.

Hash generator is for typed text. Do not send a binary through that box.

How to verify a download

  1. Copy the published hash from the official site (not a random mirror).
  2. Drop the file here. Compare, case-insensitive, ignoring spaces.
  3. If the file is bigger than about 32 MB, skip this tab:
# Windows PowerShell
Get-FileHash -Algorithm SHA256 .\setup.exe

# Windows CMD
certutil -hashfile setup.exe SHA256

# macOS / Linux
sha256sum setup.iso

Honest limits

  • SHA-256 only. No MD5 file mode, no SHA-512 file mode.
  • Match ≠ trusted publisher. Compromised sites publish matching hashes for malware.
  • We do not scan archives inside the file.

For HMAC of a string plus a key, use HMAC / password check.

FAQ

Does a matching hash mean the file is safe?

It means these bytes match the string you compared. It is not a signature, not Authenticode, and not an antivirus scan. Get the expected hash from the vendor’s own HTTPS page, not a forum mirror.

Can you hash MD5 or SHA-1 for a file?

No. This tool is SHA-256 only. For text strings (including MD5/SHA-1), use the hash generator.

My ISO is 4 GB. Why won’t it start?

Typical browser ceiling here is about 32 MB. Use the OS instead: sha256sum file.iso on macOS/Linux, or Get-FileHash -Algorithm SHA256 / certutil -hashfile file.iso SHA256 on Windows.

Why would I ever upload an installer to check its hash?

You should not. That is the joke of server-side checksum sites. Hash locally.

Is SHA-256 a digital signature?

No. Anyone can hash any file. A signature also proves who signed. We only hash.

Related tools