Hash checksums for files and text: a practical introduction

A cryptographic hash function takes input data and produces a fixed-length digest. The same input should produce the same digest with the same algorithm, while a meaningful change to the input should produce a different result.

Where checksums are useful

• Compare a downloaded file with a checksum published by a source you trust.
• Check whether two copies of a file or text produce the same digest.
• Create repeatable digests for development, testing and data-processing workflows.

The current Hash Generator can create supported SHA digests from text or a local file using the browser Web Crypto API.

A hash does not encrypt the input

Hashing is designed to be one-way. That is different from encryption, which is designed to be reversible with the correct key, and different from Base64, which is simple reversible encoding. If your task is encoding rather than integrity, use the Base64 Encoder / Decoder.

The source of the expected checksum matters

A digest only helps verify a download when the checksum you compare against comes from a source you trust.

If an attacker can replace both a file and the checksum shown next to it, a matching value does not establish authenticity.

Algorithm choice

SHA-256 is a common modern choice for general file-integrity comparisons. SHA-1 remains available in some compatibility contexts but should not be treated as the preferred choice for new security-sensitive designs.

Password warning

Generating an ordinary SHA digest is not a complete password-storage design. Password storage normally requires a dedicated password-hashing approach with salts and an intentionally expensive algorithm.