About File Hasher

Calculate file hashes (MD5, SHA256, SHA512, etc). Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

• Verify downloaded software matches the publisher's published checksum
• Detect file corruption after network transfer or storage
• Identify whether two files are identical without byte-by-byte comparison
• Generate checksums for files being distributed to ensure integrity

Tips

• Upload multiple files simultaneously — the hasher processes them in parallel and displays results in a comparison table
• Use the 'verify' input box to paste a known-good hash and automatically compare it against the calculated hash — green/red indicator shows match status
• SHA-256 is the recommended algorithm for integrity verification; MD5 and SHA-1 are available for legacy compatibility but should not be used for security purposes

Fun Facts

• SHA-256 is part of the SHA-2 family, designed by the NSA and standardized by NIST in 2001. Bitcoin uses double-SHA-256 (SHA256(SHA256(data))) for its proof-of-work algorithm — a choice that has made SHA-256 the most computationally exercised hash function in human history.
• The probability of two different files having the same SHA-256 hash is approximately 1 in 10^77 — greater than the estimated number of atoms in the observable universe (10^80). No known SHA-256 collision has ever been found.
• File integrity checking using MD5 hashes was standard practice for software downloads in the 1990s-2000s. MD5's collision vulnerability (demonstrated in 2004) made it unsuitable for security but it remains used for non-cryptographic checksums due to its speed.

FAQ

Which hash algorithm should I use for file integrity?

SHA-256 for new systems — widely supported, no known vulnerabilities, sufficient speed. SHA-512 for slightly higher security margin at the cost of larger hash output. MD5 only for legacy compatibility where SHA-256 is not supported. Never use MD5 for security-critical verification.

Can two different files have the same hash?

In theory (hash collision), but the probability is astronomically small for SHA-256. For MD5 and SHA-1, collisions are theoretically possible and have been demonstrated under controlled conditions — making them unsuitable for security use but still reliable for detecting accidental corruption.

What is HMAC and how is it different from a file hash?

A file hash is computed from data alone and verifies integrity (has the data changed?). HMAC (Hash-based Message Authentication Code) uses a secret key alongside the data, verifying both integrity and authenticity (did someone with the key produce this?). HMAC prevents an attacker from substituting a file and recalculating the hash.