"Hash calculator" vs. "checksum generator"
In everyday use these two terms are treated as synonyms, and for verifying a download they mean the same thing in practice. But there's a real distinction underneath: a hash is the output of a cryptographic hash function — MD5, SHA-1, SHA-256, SHA-512 — while a checksum is the broader category, which also includes non-cryptographic algorithms purpose-built for catching accidental corruption, like CRC-32 or Adler-32. Every cryptographic hash can be used as a checksum; not every checksum is a cryptographic hash.
This tool sticks to the cryptographic side — MD5, SHA-1, SHA-256, and SHA-512 — for exactly that reason. If you also want CRC-32 alongside them (useful when comparing against tools like zip or png that report it natively), see Checksum Generator, which covers both categories.
Which algorithm to trust
- MD5 / SHA-1 — both cryptographically broken for collision resistance. Fine for confirming a file wasn't accidentally corrupted, but a match isn't proof against deliberate tampering.
- SHA-256 / SHA-512 — the ones worth trusting when integrity actually matters, including against an adversary. If a publisher offers a SHA-256 hash alongside older ones, verify against that instead.
See MD5 vs SHA-256 vs SHA-512 for the full comparison of digest sizes, speed, and why the older algorithms are still around despite being broken.
How this is computed
Your file is read locally with the File API and hashed entirely in your browser — SHA-1/256/512 via the native Web Crypto API, MD5 via a small pure-JavaScript implementation (Web Crypto deliberately omits MD5, since it's no longer considered cryptographically secure). The file itself is never uploaded or transmitted anywhere.