You download a program and the website lists a long string beside it: "SHA-256: ba7816bf8f01cfea…". That string is a hash, and it's a quick way to prove your download is exactly the file the publisher intended.
What is a hash?
A hash function takes any input — a word, a document, a 4 GB file — and produces a fixed-length string of characters, like a fingerprint. Key properties:
- Deterministic. The same input always gives the same hash.
- Sensitive. Changing a single character produces a completely different hash.
- One-way. You can't reconstruct the input from the hash.
- Fixed length. SHA-256 always produces 64 hexadecimal characters, whatever the input size.
For example, the SHA-256 hash of the text "abc" is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.
Common hash algorithms
| Algorithm | Length | Safe for security? |
|---|---|---|
| MD5 | 32 hex characters | No — collisions can be created |
| SHA-1 | 40 hex characters | No — deprecated for security |
| SHA-256 | 64 hex characters | Yes, widely used |
| SHA-512 | 128 hex characters | Yes |
MD5 and SHA-1 still work for catching accidental corruption, but shouldn't be used where someone might try to forge a match.
How to verify a downloaded file
- Find the checksum the publisher lists (usually SHA-256) on their official site.
- Open the Hash Generator, switch to A file, and choose the downloaded file.
- Compare the SHA-256 result with the published one. If they match exactly, the file is intact and unaltered.
If they differ, the download was corrupted or modified — download it again from the official source.
Hashing runs entirely in your browser using the Web Crypto API, so the file is never uploaded.
Other uses of hashes
- Detecting duplicate files without comparing them byte by byte.
- Data integrity checks in backups and transfers.
- Digital signatures and certificates.
- Password storage — but only with specialised, slow hashes such as bcrypt or Argon2, never a plain SHA-256.
Common misconceptions
- A hash isn't encryption. There's nothing to decrypt.
- Short or common inputs can be guessed by hashing many candidates, which is why passwords need salting and slow algorithms.
- A matching hash proves the file matches the published hash — it can't prove the publisher's checksum itself hasn't been tampered with, so get it from a trusted source.
FAQ
Which hash should I use? SHA-256 is a good default for checksums today.
Why do two different files never seem to share a hash? They can in theory — that's a collision — but with SHA-256 it's astronomically unlikely.
Can I hash text as well as files? Yes. Type or paste text into the generator and all five hashes appear at once.
Try it now
Open the free Hash Generator.
Related reading
See What Is Base64 Encoding and When to Use It and How to Create a Strong Password You Can Remember. Browse the full blog for more guides.