What is a cryptographic hash?

A cryptographic hash turns input of any length into a fixed-length digest. A small input change produces a different digest, making hashes useful for integrity checks and content identification.

SHA-256 vs SHA-512

SHA-256 produces a 256-bit digest and is the most common choice for download verification. SHA-384 and SHA-512 produce longer digests from the same SHA-2 family. Use the algorithm published by the source you are verifying; different algorithms never produce interchangeable results.

Hashing is not encryption

Encryption is reversible with the appropriate key. Hashing is designed as a one-way transformation and does not let this tool recover the original input. Plain, fast SHA hashes are also not a substitute for a dedicated password hashing function such as Argon2, scrypt, or bcrypt.

How to verify a downloaded file

  1. Select the same algorithm used by the publisher.
  2. Choose the downloaded file; it is read locally.
  3. Paste the publisher’s expected hexadecimal or Base64 digest.
  4. Confirm that the comparison reports a match before relying on the file.

Why SHA-1 is legacy

Practical collision attacks make SHA-1 unsuitable for security-sensitive integrity claims. It remains available only to compare legacy checksums and is visibly marked as not recommended.

Frequently asked questions

Is my text or file uploaded?

No. Web Crypto computes the digest locally. This version limits files to 100 MB because the browser digest API reads the file into memory.

Can two different files have the same hash?

That is called a collision. Modern SHA-2 algorithms are designed to make finding collisions computationally infeasible, but no fixed-length hash can be mathematically collision-free.