File Checksum Calculator (SHA-256 / SHA-512)
Calculate SHA-256 and SHA-512 checksums of a file or text in your browser and check them against a published hash. Files are never uploaded.
- Runs in your browser (no upload)
The file is not uploaded. Web Crypto cannot hash in chunks, so the whole file is read into this device’s memory. Up to 256 MB per file
Compare with a published hash
Paste the value from the download page. Case and spaces are ignored. Also accepts "hash filename" lines, multi-line files such as SHA256SUMS, "sha256:…" and SRI ("sha256-…").
How to use
- Choose "File" or "Text", then pick a file (or type the text).
- Select the algorithms. SHA-256 and SHA-512 are on by default; you can add SHA-384 and legacy SHA-1.
- Paste the published hash into "Expected hash" to see right away whether it matches.
FAQ
Is my file uploaded?
No. The file is read into this device’s memory and hashed by the browser’s built-in Web Crypto API (crypto.subtle.digest). File contents, text and hashes are never sent, stored or logged.
Is there a size limit?
Up to 256 MB per file. Web Crypto cannot hash in chunks, so the whole file has to be read into memory. For bigger files use "certutil -hashfile file SHA256" on Windows, "shasum -a 256 file" on macOS or "sha256sum file" on Linux.
Which algorithm should I use?
Use the one the publisher lists. SHA-256 is the most common. SHA-1 collisions were demonstrated in 2017, so use SHA-1 only to match old published values. MD5 is not supported.
Why does my text hash differ from another tool?
Usually because of line endings (LF vs CRLF), a trailing newline (the echo command adds one) or a different text encoding. This tool hashes exactly the UTF-8 bytes of the text you typed.
Does a match mean the file is safe?
A match only shows that the content equals the file the hash was made from; it does not scan for malware. If an attacker replaced both the file and the published hash, they would still match, so get the hash from the official HTTPS site or a signed source.
Notes & limitations
- What you enter is processed only on this page and is not sent to YUCTS servers.
- Files up to 256 MB. The whole file is read into memory, so very large files can be slow or fail on phones with little memory.
- Supported algorithms: SHA-256, SHA-512, SHA-384 and SHA-1. MD5, CRC32, SHA-3 and BLAKE are not supported.
- A matching hash only shows identical content; it is not a malware scan or a digital signature (e.g. GPG) check.
- Files and text are processed only in your browser and are never sent, stored or logged.
Data sources
- NIST FIPS 180-4: Secure Hash Standard (SHS)(opens in a new tab) (FIPS 180-4 (August 2015)) — Checked on: 2026-10-31
- W3C Web Cryptography API (SubtleCrypto.digest)(opens in a new tab) — Checked on: 2026-10-31
Related tools
- Secure Password Generator (cryptographic, unbiased)Create random passwords in your browser with a cryptographically secure, unbiased generator (crypto.getRandomValues). Choose length, character types and look-alike exclusion, and see the entropy.
- Password Strength Checker (guessability and crack time)Estimate how guessable a password is from its length, character types, common passwords, keyboard runs, sequences and dates, with crack-time ranges. Runs in your browser; nothing is sent or saved.
- UUID Generator and Inspector (bulk UUID v4)Generate up to 10,000 random version 4 UUIDs at once with crypto.randomUUID(), then copy them or save a TXT file. Paste any UUID to see its version, variant and embedded time.
- Text Encryption & Decryption (AES-256-GCM with a password)Encrypt and decrypt text with a password using AES-256-GCM and PBKDF2 in your browser. Random salt and nonce, tamper detection, and nothing is sent or stored.
- Personal Data Redaction for TextFind and mask email addresses, phone numbers, card numbers, Japanese My Number, Taiwan IDs, IP addresses and URLs in text. Runs entirely in your browser; nothing is sent or saved.
- Suspicious URL Structure Checker (@, IP, Punycode, short links)Paste a URL to list structural features such as “@” tricks, numeric IP hosts, Punycode and mixed scripts, URL shorteners and double extensions. It never opens the link and gives no safety verdict.