年齢計算

What a file hash actually is

A file hash is a short, fixed-length fingerprint computed from the entire contents of a file. Feed in a 2 KB text note or a 4 GB disc image and a hash function such as SHA-256 always returns the same length of output — 64 hexadecimal characters. The defining property is that the output changes drastically and unpredictably if even a single byte of the input changes. Flip one bit in a movie file and the new hash bears no resemblance to the old one. That is exactly what makes a hash useful: it lets you confirm two files are byte-for-byte identical without comparing them in full, and it lets you detect tampering or corruption instantly.

This tool computes three hashes at once — SHA-1, SHA-256, and SHA-512 — using the browser's built-in WebCrypto crypto.subtle.digest implementation. The file is read into memory on your device and hashed locally; nothing is uploaded. You can verify this by disconnecting from the internet: the tool still works, because there is no server in the loop.

The three algorithms, and why no MD5

MD5 is deliberately absent. It is not exposed by the browser's WebCrypto API, and more importantly it is cryptographically broken — researchers can craft two different files that share an MD5 hash (a "collision"). SHA-1 is also broken in that adversarial sense, so the tool shows it for compatibility with legacy checksums but flags SHA-256 or SHA-512 as the right choice when security matters.

A worked example: verifying a download

Say you download ubuntu-24.04.iso and the official page publishes the line SHA256: a1b2c3…. Drop the downloaded file onto this tool, wait for the SHA-256 field to fill in, and compare it character-by-character to the published value. If the first 60 characters match but two in the middle differ, the file is not the same — the download was corrupted or tampered with, and you should not run it. If every character matches, you have strong assurance the file is the exact one the publisher released. Because hashing a multi-gigabyte file means reading it all into memory, the progress bar moves through two phases: reading the file (up to 50%), then computing each of the three digests (the remaining 50%).

Genuine use cases

• Download verification. Confirm an installer, ISO, or firmware image matches the publisher's checksum before trusting it.
• Detecting silent corruption. Hash a backup today and again next year; a changed hash on an archive you never edited points to bit-rot or a failing drive.
• Deduplication. Two photos with identical SHA-256 hashes are the same image, even if the filenames differ.
• Evidence and chain-of-custody. Recording a file's hash at a point in time proves later that the file was not altered.
• Spotting "identical-looking" but different files. Two documents that render the same on screen but have different hashes contain different bytes — useful when checking for hidden edits.

Common mistakes when comparing hashes

• Comparing different algorithms. A SHA-256 value will never equal a SHA-512 value, even for the same file. Match like with like — compare the publisher's SHA-256 to this tool's SHA-256 field.
• Eyeballing only the ends. Attackers and corruption can change bytes anywhere. Copy both values and compare them in full, or paste them into a diff; do not just glance at the first and last few characters.
• Worrying about letter case. Hex hashes are case-insensitive. A1FF and a1ff are the same value; normalise before comparing.
• Treating a matching hash as proof of safety. A hash confirms the file equals a specific reference. If the reference checksum itself came from an untrusted source, a match proves nothing. Always get the expected hash from the original, trusted publisher over HTTPS.
• Expecting a hash to encrypt anything. Hashing is one-way and reveals nothing secret, but it also protects nothing — it is for integrity, not confidentiality.

Why doing this in the browser matters

Many online checksum tools ask you to upload your file to their server. For a public ISO that is merely slow; for a private document, contract, or photo it means handing a copy to a third party. Because this calculator runs entirely on your device through WebCrypto, even a sensitive file is hashed without ever leaving your computer — you get the same trustworthy fingerprint with none of the exposure.