About File Hash
File Hash computes the MD5 and SHA-256 digests of a file you select, and reports them alongside the file's name and its size in bytes. It is the tool for checking that a download arrived intact: compare the digests against the ones the publisher lists, and a match confirms the bytes are exactly what was published.
Both hashes are computed over the file's raw bytes, with no character encoding in between, so they are the true digests of the binary content and match what command-line tools produce for the same file. Every byte is read into memory to do this, which means the operation is bounded by how much memory the browser tab can use — comfortable for documents, images, installers and archives, potentially slow for files of many gigabytes.
Two things the tool does not do. It offers MD5 and SHA-256 but not other algorithms such as SHA-1 or SHA-512, and it does not compare the result against an expected value for you — you read the digest and check it yourself. The file is processed entirely in the browser, so nothing is uploaded anywhere.
How to use File Hash
- 1 Select the file you want to fingerprint.
- 2 Run the tool to see its MD5 and SHA-256 digests alongside the file name and size.
- 3 Compare the digests against the published checksums to confirm the file is intact.
Frequently asked questions
Does the hash depend on the file name?
No. Only the file's contents are hashed, so renaming a file does not change its digests. That is exactly why a publisher's checksum can confirm the content even when the download was saved under a different name.
Why are both MD5 and SHA-256 shown?
Because publishers list one or the other, so having both lets you compare against whichever is provided. MD5 is faster and still common for download checksums, while SHA-256 is the stronger choice and the one to prefer when integrity against tampering matters.
Is the file uploaded to a server?
No. The file is read and hashed locally by JavaScript in the page, so it never leaves your device. That also means the tool works offline.
What happens with a very large file?
The whole file is held in memory while it is hashed, so extremely large files can be slow or can exhaust the tab's memory. For multi-gigabyte files a native command-line tool is more suitable.
Free, online, and private
Free to use
File Hash is completely free. There is no account to create, no login, and no hidden charge or usage limit.
Runs online in your browser
It is a free online tool that runs entirely in your browser. Nothing to download or install — open the page and start using it right away.
Your data stays private
All processing happens locally on your device. Your input is never uploaded, stored, or tracked, so it never leaves your browser.
How File Hash behaves in detail
These are the specifics of this implementation — the exact ranges, defaults and fixed settings you are working with.
| Parameter | Value |
|---|---|
| Output rows | the file name, its byte total, then MD5 and SHA-256 in lowercase hex |
| Byte handling | the file is read with file.arrayBuffer() and hashed as raw bytes, never re-encoded |
| MD5 path | a bundled JavaScript implementation (md5Bytes) rather than a platform primitive |
| SHA-256 path | crypto.subtle.digest over the same byte array |
| No file chosen | the single line Choose a file first |
| Empty file | accepted — 0 bytes returns MD5 d41d8cd98f00b204e9800998ecf8427e and SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
Compiled from the implementation of this tool and checked against it by itoolnet.
What File Hash does not do
Knowing the edges of a tool saves more time than another list of its features. These are the cases where it will not do what you might expect.
- The file is read into memory in one call with file.arrayBuffer(), and there is no streaming path. A file larger than the tab can hold fails or exhausts memory instead of being hashed in chunks, and no warning is given before the attempt.
- Only two digests are produced. SHA-1, SHA-512 and the CRC and Adler checksums live on other pages, so a download page that publishes only a SHA-512 value cannot be checked against this output on its own.
- The result is a block of text with no comparison step. There is no expected-hash field, so nothing tells you whether the value you were given matches — you compare the strings yourself or take the text to the checksum verifier.
Tested and documented by itoolnet, the team that builds and maintains this site.