File Hash Calculator
File Hash Calculator reads the first selected file and passes its complete bytes to the browser Web Crypto API. It returns a lowercase hexadecimal SHA-1, SHA-256, SHA-384, or SHA-512 digest. A digest helps identify exact bytes, but it does not prove who created a file, whether it is safe, or whether a separately supplied checksum is trustworthy.
Runs locally — files stay on your deviceWhat changes a file hash?
Any byte-level change normally produces a different digest, even when the filename looks unchanged.
A digest is a fingerprint of bytes
A cryptographic hash maps arbitrary input bytes to a fixed-length value. SHA-256 produces 256 bits, displayed here as 64 hexadecimal characters.
How it works
The page reads the first selected file into memory, calls crypto.subtle.digest with the chosen algorithm, and converts every result byte to two lowercase hex digits.
Key concepts
Exact bytes matter
Metadata embedded inside a file is part of its bytes; an external filename is not.
Trust comes from comparison
A computed digest is useful only when the expected value and its source are trustworthy.
When to use it
- Compare a downloaded file with a checksum published through a trusted channel.
- Record a content identifier before transfer.
- Confirm two copies have identical bytes.
When not to use it
- Do not treat a digest as malware scanning.
- Do not use SHA-1 for new collision-resistant security designs.
- Do not trust a checksum obtained from the same compromised location as the file.
Worked examples
SHA-256 release check
- Input
installer.bin- Expected output
64 hex characters
Compare every character with the publisher's authenticated value.
Renamed copy
- Input
Same bytes under another filename- Expected output
Same digest
The external name is not hashed.
One edited byte
- Input
Modified file- Expected output
Different digest
Hash functions are sensitive to byte changes.
Common mistakes
Hashing several files at once
This page hashes only the first selected file. Correction: Process each file separately or use the manifest tool.
Calling a match authentic
An attacker can replace both file and checksum. Correction: Obtain the expected digest independently.
Comparing by sight carelessly
Long hex strings are easy to misread. Correction: Use the checksum comparator.
Best practices
- Prefer SHA-256 or stronger for modern verification.
- Verify algorithm, filename, and checksum source.
- Keep the full digest without added spaces.
Related operations and differences
File Checksum Comparator
Choose File Checksum Comparator when you need to compare a file digest with an expected checksum.; use File Hash Calculator specifically for hash.
Add Prefix to Filenames
Choose Add Prefix to Filenames when you need to add a prefix to selected filenames.; use File Hash Calculator specifically for hash.
Add Suffix to Filenames
Choose Add Suffix to Filenames when you need to add a suffix before every extension.; use File Hash Calculator specifically for hash.
Compare Two Files
Choose Compare Two Files when you need to compare two files securely by SHA-256.; use File Hash Calculator specifically for hash.
File Size Calculator
Choose File Size Calculator when you need to inspect exact and human-readable file sizes.; use File Hash Calculator specifically for hash.
File to Base64
Choose File to Base64 when you need to encode a local file as Base64.; use File Hash Calculator specifically for hash.
Limitations and privacy
- Only the first selected file is hashed.
- The complete file is buffered in browser memory.
- No signature verification, malware scan, directory hashing, or authenticity assessment.
Processing happens in this browser. Selected file contents are not uploaded by this tool.
Downloads and copied results remain on this device; handle them according to their sensitivity.
Frequently asked questions
Is the filename included?
No.
Can two different files share a hash?
Collisions are theoretically possible; modern SHA-2 algorithms are designed to make them impractical.
Which algorithm should I choose?
Use the algorithm specified by the trusted checksum source; otherwise prefer SHA-256 or stronger.
Are multiple files combined?
No, only the first file is processed.