Calculator
What the Hash Verifier does
Hash Verifier: transforms Result from Text, Expected hash and Algorithm.
With Text, Expected hash and Algorithm entered, the Hash Verifier works out Result. Change any input and the output follows immediately.
Reusing a password is still the single most common way accounts fall over. That is usually what brings someone verifying a download here.
Everything happens inside this page. Nothing you type is sent to a server, and there is nothing for us to store.
Field definitions, the method, and a worked example from the default values are all set out further down the page.
What do the Hash Verifier fields mean?
The Hash Verifier uses 3 inputs. None of the boxes start empty. The page loads with a worked set of values you can edit or replace.
| Field | What to enter | Default |
|---|---|---|
| Text | paste or type any amount of text | The quick brown fox |
| Expected hash | required | none |
| Algorithm | choose from SHA-256, SHA-1 or SHA-512 | SHA-256 |
How does the Hash Verifier work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same transformation.
Bad input produces a message, not a silently incorrect figure.
What a typical run looks like
You provide: Text, Expected hash and Algorithm
What happens: the file is read into memory by your browser, processed locally, and offered back as a download. It is never uploaded.
You get back: the finished file to download, with a line in the panel saying what was done.
Because the work is local, speed depends on your device rather than our servers, and large files are limited only by available memory.
What a hash match actually proves
This tool recomputes the hash of your text and compares it, character for character, against the value you paste in. A match proves the text is byte-identical to whatever produced that hash, nothing less, and nothing more.
Worth knowing
- A hash match does not tell you the text is safe, trustworthy, or unmodified by anyone able to also change the published hash alongside the file: it only tells you the two specific things you compared are identical to each other.
- This tool compares case-insensitively, since hex digests are conventionally written lowercase but a copy-pasted hash may arrive in any case. The underlying comparison is otherwise exact, byte for byte.
- If you are verifying a downloaded file against a publisher-supplied hash, fetch that hash from a channel independent of the download itself. A compromised mirror serving a tampered file could just as easily serve a matching, equally tampered hash.
- On a server, comparing anything security-sensitive (session tokens, HMAC signatures) should use a constant-time comparison function rather than a short-circuiting equality check, which can leak timing information about how many leading bytes matched.
Read next: How Hashing Works: MD5, SHA-1, SHA-256 and Why Two Are Broken
How to use it
- Paste your content into Text.
- Enter Expected hash.
- Pick a value for Algorithm: the options are SHA-256, SHA-1 or SHA-512.
- The answer follows your cursor, in effect. Change a field and read the new figure.
- Look at Result in the output panel.
- Use Copy Link if you want the same setup again later, or Print for a paper copy.
What this tool does not do
- Randomness comes from your browser's cryptographic random source, which is suitable for passwords and keys.
- Anything generated here is only as safe as where you store it afterwards.
- Values outside the documented ranges are rejected rather than approximated.
Frequently asked questions
The form asks for Text, Expected hash and Algorithm. Each field is pre-filled with a sensible default, so the form is usable immediately, without filling anything in first.
No. Your browser is doing the computing, so we could not see the values even if we wanted to.
Free for any use, personal or commercial.
As accurate as the inputs allow. The arithmetic itself introduces no error beyond display rounding.