Hash Generator

A hash turns an input into a digest of a fixed length. The same input always gives the same digest. A small change to the input gives a fully different digest.

Use the File source to check a download against the checksum of the publisher. The tool reads the file in pieces and gives each piece to the hasher, so a file of up to 2 GB never leaves your browser and never sits in memory as one block.

The JSON object source gives a stable digest for an object. The tool sorts the keys at every level, keeps the order of each array, and writes the text with no spaces and no line breaks. The same content in a different key order then gives the same hash. Use it as a cache key, a deduplication key, or a change detector for a config object.

The JSON rules have three more effects. The tool sorts the keys by their code unit value, so Z comes before a. The tool writes each number in the standard JSON form, so 1.0 becomes 1 and 1e3 becomes 1000. The tool removes a comment and a trailing comma, because it reads JSON5 and JSONC input. Hash the canonical text below to reproduce the digest.

Select Download Checksum to save the result as a checksum file. The file holds the digest, two spaces, and the name of your file, which is the format of sha256sum. Put the file next to the input file, then run sha256sum -c archive.zip.sha256 to check the file on a Linux or a macOS machine. The file is made in your browser, and the name of your file stays on your device.

Text encoding

The tool converts your text to UTF-8 bytes, and hashes the bytes. A character outside the ASCII set is more than one byte: é is 2 bytes and 😀 is 4 bytes. A hash of text is a hash of bytes, so the encoding is part of the input.

Three details change the digest, and each one is easy to miss. A byte order mark at the start of a file is 3 bytes. A Windows line break is 2 bytes, and a Unix line break is 1 byte. A last empty line adds a byte. Compare a checksum against the exact bytes of the file, and use the File source for a file.

Paste the hash of the publisher into the expected hash field to get a Match or a Mismatch result. The field accepts hex and Base64, in upper case or in lower case. The compare reads every byte of both values, so its run time does not depend on the content.

These digests are not password hashes. A password needs a slow algorithm such as bcrypt, scrypt, or Argon2. Do not store a password with MD5, SHA-1, or SHA-256.

A digest is also not a signature. It proves that two inputs are the same. It does not prove who made the input, because anybody can calculate the same digest. A signature needs a key: use the HMAC Generator for a shared key, or a public key signature.