CM Hash Studio

v2

File hashes & SRI integrity generator

Drop a file, paste text, or point at a URL. Get MD5 / SHA-1 / SHA-256 / SHA-384 / SHA-512 in one pass, plus a ready-to-paste integrity attribute.

Runs in your browser default

Local files, text, and any URL that allows cross-origin reads. The bytes never leave your device — the server sees neither the content nor the filename. No size limit: past 1 GB it switches to streaming chunks, so memory stays flat and only the clock moves.

Fetched by the server fallback

One trigger only: you gave a URL and its CORS policy stops the browser from reading it. There is no upload endpoint — files can never reach the server. When it does fetch, it hashes the stream and drops it: nothing written to disk, cached, or sent back. Limits: 50 MB, ports 80/443 only, no private or reserved addresses, 3 redirects, 20 s.

Drop files here, or click to choose Multiple files, any size. Nothing leaves your device.

MD5 and SHA-1 are collision-broken — fine for transfer checks, not for security. SRI accepts SHA-256/384/512 only.
Hex (any case, spaces or colons fine) and SRI form both work. Pasting SRI selects the matching algorithm.

Results

Nothing yet. Pick a source and hit Compute.
About SRI: The browser re-hashes whatever it downloads and refuses to run it if the digest does not match integrity. That defeats a tampered CDN — but only if you trust the download the digest came from. Prefer hashing an officially published file locally over having a server fetch a source you have not verified.

Frequently asked questions

Are my files uploaded?

No. There is no upload endpoint on this page. Local files and text are always hashed in your browser — with Web Crypto when it is available, with the bundled streaming implementation when it is not. The server only reaches the network when you give it a URL that the target site’s CORS policy stops the browser from reading.

How large a file can it handle?

Locally, there is no limit. Up to 1 GB the whole file goes to Web Crypto for native speed; past that it switches to streaming chunks, so memory stays flat and only the clock moves. The pure-JS path measures roughly 100–390 MB/s depending on the algorithm. Only the server-fetched-URL path is capped, at 50 MB.

What is SRI integrity, and which algorithm should I use?

Subresource Integrity makes the browser re-hash a script or stylesheet it loaded from a CDN and refuse to run it unless the digest matches the integrity attribute, which defeats a tampered CDN. The spec accepts SHA-256, SHA-384 and SHA-512; SHA-384 is the usual choice.

Can I still use MD5 and SHA-1?

For checking that a download arrived intact, yes. For any security decision, no — both are collision-broken, meaning an attacker can craft a different file with the same digest. Use SHA-256 or stronger to verify that a file is genuine.