Compute the SHA-256 of a file
Get the SHA-256 fingerprint of any file. Same value you'd get from shasum -a 256 in a terminal.
Drop your file here
or click to browse
Nothing has left this page since you opened the tool. Show network activity
The browser enforces this: the site’s security policy only lets the page talk to the code libraries’ servers and an anonymous usage counter (tool name, file type, size range). A request carrying your file to anywhere else would be blocked before it left.
Check it yourself: open your browser’s developer tools, go to the Network tab, and run the tool. Or turn off Wi-Fi once the tool has loaded; it keeps working.
How it works
Get the SHA-256 fingerprint of any file. Same value you'd get from shasum -a 256 in a terminal.
Drop any file. The Web Crypto API computes SHA-256 in your browser, returning a 64-character hex digest. Useful for verifying a download matches the publisher's checksum, deduplicating files, or proving a file hasn't changed between two points. The same file produces the same hash everywhere: in this tool, in a terminal (shasum -a 256, openssl dgst -sha256, sha256sum), or in any SHA-256 library. The hash function is one-way, you can't recover the file from the hash. There's no file size limit; the algorithm streams over the file via crypto.subtle.digest. Copy the hash with one click and paste it where you need.
How to use it
- Drop your file. Any file type and size works — hashing streams over the bytes locally.
- Read the digest. The 64-character SHA-256 hex digest appears, identical to shasum -a 256 output.
- Copy and compare. Copy the hash with one click and compare it to the publisher's checksum to verify the download.
Frequently asked questions
- What hash algorithm does this use?
- SHA-256 via the Web Crypto API. The output matches shasum -a 256, openssl dgst -sha256, and the sha256sum utility.
- Is my file uploaded for hashing?
- No. Web Crypto runs in the browser, the file's bytes never leave your device.
- Can I verify a download checksum with this?
- Yes. Compute SHA-256 here, compare to the value published by the source. If they match, the file is intact.
- Why SHA-256 and not MD5?
- MD5 is broken (collisions are easy). SHA-256 is the modern standard. For other algorithms applied to text, see Hash text.