Drop a file, paste text, or point at a URL. Get MD5 / SHA-1 / SHA-256 / SHA-384 / SHA-512 in one pass, plus a ready-to-paste integrity attribute.
Local files, text, and any URL that allows cross-origin reads. The bytes never leave your device — the server sees neither the content nor the filename. No size limit: past 1 GB it switches to streaming chunks, so memory stays flat and only the clock moves.
One trigger only: you gave a URL and its CORS policy stops the browser from reading it. There is no upload endpoint — files can never reach the server. When it does fetch, it hashes the stream and drops it: nothing written to disk, cached, or sent back. Limits: 50 MB, ports 80/443 only, no private or reserved addresses, 3 redirects, 20 s.
integrity. That defeats a tampered CDN — but only if you trust the download the digest came from. Prefer hashing an officially published file locally over having a server fetch a source you have not verified.
No. There is no upload endpoint on this page. Local files and text are always hashed in your browser — with Web Crypto when it is available, with the bundled streaming implementation when it is not. The server only reaches the network when you give it a URL that the target site’s CORS policy stops the browser from reading.
Locally, there is no limit. Up to 1 GB the whole file goes to Web Crypto for native speed; past that it switches to streaming chunks, so memory stays flat and only the clock moves. The pure-JS path measures roughly 100–390 MB/s depending on the algorithm. Only the server-fetched-URL path is capped, at 50 MB.
Subresource Integrity makes the browser re-hash a script or stylesheet it loaded from a CDN and refuse to run it unless the digest matches the integrity attribute, which defeats a tampered CDN. The spec accepts SHA-256, SHA-384 and SHA-512; SHA-384 is the usual choice.
For checking that a download arrived intact, yes. For any security decision, no — both are collision-broken, meaning an attacker can craft a different file with the same digest. Use SHA-256 or stronger to verify that a file is genuine.