Skip to content
littlekit.app

Hash file

Calculate a local SHA-256, SHA-384, or SHA-512 fingerprint of any file and compare an expected checksum.

Choose a file to fingerprint

Choose a file to get started, or drag and drop it here.

Any file type · up to 32 MiB

A fingerprint of every byte

Choose a file, then calculate its checksum.

256bits · 64 hexadecimal characters

Hashes are one-way fingerprints, not encryption. Use a dedicated password-hashing function for stored passwords.

Compare with an expected checksum
Paste a SHA-256 hexadecimal checksum. Letter case is ignored.

The complete file is read into memory for Web Crypto. Files stay on your device.

Processed on your device

How it works & useful details

How to use this tool

Choose any file type, select a hash algorithm, and calculate the checksum. Open the comparison option to check an expected digest.

Details and limits

The hash covers the file bytes, not its filename or filesystem metadata. A matching checksum only confirms the same bytes as that checksum; trust depends on where the expected checksum came from.

One file up to 32 MiB. The entire file is read into memory for Web Crypto; cancellation clears the result but cannot interrupt a digest already running inside the browser. No upload is needed.

About this tool

Hash file computes a SHA-256, SHA-384, or SHA-512 fingerprint of a file on your device and can compare it against an expected checksum. It is the standard way to confirm that a download matches the publisher’s value.

The file is read locally and never uploaded. Hashing confirms integrity against a value you trust; it is not a signature and does not prove who produced the file.

How to use it

  1. Choose the file you want to fingerprint.
  2. Select the hash algorithm that matches the published checksum.
  3. Optionally paste the expected value to compare.
  4. Read the digest and whether it matches.

Worked example: verifying a download

  • Download the file, and copy the SHA-256 checksum from the publisher's official download page or release notes.
  • Choose the file here, keep SHA-256 selected, and paste the published value into the comparison field.
  • A match means your file has exactly the same bytes as the file the publisher hashed. Any difference, even one flipped bit from a corrupted download, produces a completely different checksum.

Linux distributions, open-source releases, firmware updates, and backup archives commonly publish SHA-256 sums. On the command line the equivalents are sha256sum on Linux, shasum -a 256 on macOS, and Get-FileHash in PowerShell. All produce the same hexadecimal value as this tool.

What a matching checksum does and does not prove

A checksum proves integrity: the bytes match. It only proves authenticity if the expected value came from a trusted source. If an attacker can replace the file on a download mirror, they can often replace a checksum shown on the same page too. For stronger assurance, compare against a checksum from a separate channel, or verify a cryptographic signature (GPG, Sigstore, or code signing) when the publisher provides one.

The hash covers only the file's content, not its name, dates, or permissions. Renaming a file does not change its SHA-256.

Frequently asked questions

Which algorithm should I use?

SHA-256 is the common default. Follow the publisher’s checksum if one is provided so the comparison is meaningful.

What is the file size limit?

Up to 32 MiB per file, processed locally without uploading.

Does a matching hash prove the file is safe?

No. It only proves the bytes match the checksum you compared against; trust depends on where that checksum came from.

Why is MD5 or SHA-1 not offered?

Both have practical collision attacks, meaning two different files can be crafted with the same hash. SHA-256, SHA-384, and SHA-512 are the current standard choices for integrity checks.