How to Use This Tool
Type text or drop a file. All four hashes are computed at once, and if you paste a published checksum it is compared for you.
A hash is not encryption
Encryption is reversible with a key. Hashing is one-way and has no key: a hash of a gigabyte and a hash of one letter are both 64 hex characters, so most of the input has been thrown away. There is nothing to decrypt, and any site offering to "decrypt" a hash is either looking it up in a table of precomputed common inputs or lying.
What a hash is good for is integrity. If a file's SHA-256 matches the one the publisher printed, the bytes you have are the bytes they released. Change one bit and the hash changes completely.
Do not store passwords like this
This is the most consequential misuse. SHA-256 is designed to be fast, and that is exactly wrong for passwords: modern hardware computes billions of SHA-256 hashes per second, so a stolen table of unsalted hashes falls to a dictionary attack in a very short time.
Password hashing wants the opposite property. bcrypt, scrypt and Argon2 are deliberately slow and memory-hungry, with a tunable cost, and they salt each password so identical passwords produce different hashes. Use a library that implements one of them; do not build this from SHA-256 and a salt yourself.
MD5 and SHA-1 are broken
Both are shown because you still meet them, and both are broken for security. Researchers can construct two different files with the same MD5 hash cheaply, and the same has been demonstrated for SHA-1. That means neither can prove a file is the one you expected against a determined adversary.
They remain fine as non-adversarial checks — detecting a corrupted download, deduplicating files, cache keys — where nobody is trying to trick you. If a publisher only offers MD5, it still catches transmission errors; it just does not prove authenticity. Note that MD5 is not available here, because browsers deliberately do not implement it.
Checking a download
- Get the checksum from the publisher's own site, over HTTPS — not from the same place as the file if that place could be compromised.
- Drop the file here and compare. This page never uploads it, so a large or private file is fine.
- A mismatch means the file is not what was published. That is usually a corrupted or interrupted download, and occasionally something worse.
A caveat worth stating: if an attacker can replace the file, they can often replace the checksum printed next to it. A checksum from the same compromised page proves little. Signatures — GPG, or a platform's own code signing — are what actually establish authenticity, because they involve a key the attacker does not have.
