CrispUtils

Hash toolkit — checksums for text and files

Hash a string or a whole file with every common algorithm at once, and compare two values to see whether a download arrived intact. Large files are read straight from disk and never uploaded.

Your file is processed by your own browser. Nothing is uploaded, stored or logged.

A hash is a fixed-length fingerprint of some data. Change a single bit of the input and the output changes completely, which makes hashes the standard way to check that a file you downloaded is exactly the file that was published.

Uploading a file to a website just to get its checksum defeats the purpose and is slow for anything large. Here the file is read directly from your disk in your browser and hashed in memory. SHA algorithms use your browser's native WebCrypto, so they run at full speed; MD5 and CRC32 are implemented in JavaScript because browsers deliberately do not offer MD5.

How to use this tool

  1. For text, type or paste into the text tab. All six hashes update as you type.
  2. Change the input encoding if your text is hex or base64 rather than plain UTF-8 — the bytes being hashed differ, so the result does.
  3. For a file, switch to the file tab and drop it in. Nothing is uploaded; large files simply take a moment to read.
  4. Copy the value you need with the button beside each algorithm.
  5. To check a download, use the compare tab: paste the published checksum and the one you computed. Case and whitespace are ignored.

Worked example

Verifying a downloaded ISO

A project publishes a SHA-256 checksum next to its installer. You drop the downloaded file into the file tab, copy the SHA-256 value, and paste both into the compare tab. A match means the file is byte-identical to the one published; a mismatch means a corrupted download or something worse.

Spotting a silently changed file

You keep the SHA-256 of a configuration file. Months later you hash it again and the values differ — something changed it, even though the modification date looks plausible.

Common use cases

  • Checking that a large download completed without corruption
  • Verifying a file against a checksum published by its author
  • Confirming two copies of a file in different places are identical
  • Producing a checksum to publish alongside a release
  • Comparing a hash from a log or ticket with one you compute yourself
  • Generating a stable fingerprint for a piece of text

Common mistakes

  • Using MD5 or SHA-1 for security — Both are broken against deliberate collisions. They are fine for spotting accidental corruption and nothing else — use SHA-256 when an attacker might be involved.
  • Hashing a password directly — Plain hashes are far too fast for passwords. Use bcrypt, scrypt or Argon2 with a per-user salt; a raw SHA-256 of a password can be brute-forced at enormous speed.
  • Ignoring encoding — The same visible text in UTF-8 and UTF-16 is a different sequence of bytes and hashes differently. So does a trailing newline.
  • Trusting a checksum from the same page as the file — If an attacker can replace the download they can replace the checksum beside it. A checksum is only meaningful when it comes from an independent channel.

Frequently asked questions

Is my file uploaded to compute the hash?

No. The browser reads the file from your disk into memory and hashes it there. Nothing is transmitted, so even multi-gigabyte files are handled without a slow upload.

Which algorithm should I use?

SHA-256 for anything that matters. MD5 and CRC32 are still widely published for corruption checking and are included for that reason, but neither should be relied on where someone might be deliberately trying to produce a collision.

Why is MD5 slower than SHA-256 here?

Browsers provide SHA-1, SHA-256, SHA-384 and SHA-512 natively through WebCrypto, so those run as compiled code. MD5 is deliberately excluded from that API, so it is implemented in JavaScript.

The checksum does not match — what now?

Download the file again; an interrupted transfer is the most common cause. If a fresh download still mismatches, check you are comparing the right algorithm — a SHA-256 value is 64 hex characters, MD5 is 32. If it still fails, do not run the file.

Can I hash several files at once?

One at a time in the file tab. Hash each and compare the values you need.

Is CRC32 a hash?

Strictly it is a checksum designed to catch transmission errors, not a cryptographic hash. It is fast and appears in ZIP archives and network protocols, but it is trivial to forge and must never be used for integrity against an attacker.

Last updated 2026-09-26