A hash tells an attacker what to look for.
A leaked password hash, a signing key, an unreleased build: the moment one of those is uploaded, it is in someone else's log. This page has no request to make, so there is nowhere for it to go.
Pikkola Hash, tool No. 12
A digest that never leaves the tab.
Hash text five ways, sign it with HMAC, check a multi-gigabyte file without uploading a byte, and read a token. The browser you already have does the arithmetic.
Open the lab
UTF-8, any file size
- 0
- bytes uploaded
- 5
- hash algorithms
- 2
- HMAC modes
- 4
- encoders
Text in
hello@pikkola.com
SHA-256 out
681e475aa7b24202db4db5a92103b098f006fe0c6837112376e115b42f3b0826
The bench
Six jobs, one tab
Pick a job on the left. Nothing on this page makes a network request, so a password, a private key or a backup file stays exactly where it is.
SHA-256
SHA-512
SHA-384
SHA-1
MD5
Type something above to see the digests.
HMAC-SHA256
HMAC-SHA512
HMAC proves a message came from someone who holds the key. It is a signature, not encryption, so the message stays readable.
Drop a file here
or press to choose one. The file is read in 8 MB slices and hashed as it goes, so an 8 GB image works on a laptop with 8 GB of memory.
SHA-256
MD5
Spaces and capitals are ignored. A checksum covers the exact bytes, so a file saved with a final line break hashes differently from one without it.
Hex is written as UTF-8 bytes, two characters each.
Header
Payload
Signature
The signature is shown, not checked. Verifying needs the issuer's public key, which is a different job with a different tool.
UUID v4
NanoID
Both draw from the browser's cryptographic random source, which is the same source a password manager uses.
Latest
Reference
What each algorithm gives you
A digest is a fixed length fingerprint of a byte stream. Change one byte and the whole fingerprint changes, which is what makes it useful for checking a file and for naming a commit.
MD5 and SHA-1 are here because download pages and build scripts still publish them. Use SHA-256 when you are deciding anything about safety.
| Algorithm | Output | Hex | Where it still appears |
|---|---|---|---|
| SHA-256 | 256 bits | 64 | Signatures, certificate pinning, release checksums. The default choice. |
| SHA-512 | 512 bits | 128 | Longer digests on 64-bit systems, and where a platform asks for it. |
| SHA-384 | 384 bits | 96 | A truncated SHA-512, used by several TLS suites. |
| SHA-1 | 160 bits | 40 | Legacy: Git object names and older signatures. Not for new security work. |
| MD5 | 128 bits | 32 | Legacy: transfer checks and cache keys. Broken against collisions. |
Why local
The three reasons a checksum tool should not be a website that uploads.
Files are read in slices.
The file is opened through the browser's own reader and handed to a streaming hash 8 MB at a time. A backup image hashes without ever sitting in memory whole.
The result is the same as the command line.
The algorithms are the published ones, byte for byte. A digest here matches sha256sum, shasum -a 256 or certutil on the same file, because it is the same arithmetic.
No upload. No account. No record of what you hashed.
The text, the key and the file stay in the tab. Closing it throws them away, which is the point when the file is a contract or a private key.
Read the privacy noteQuestions
Asked with a checksum at hand
Is my text or file sent anywhere?
No. Every digest is computed by a function in the page. There is no request in the page at all, and a content security policy blocks every other origin.
Can it hash a file bigger than my memory?
Yes. The file is opened through the browser's file reader in 8 MB slices and fed to a streaming hash, so a large image works on an ordinary laptop.
Why is MD5 still here?
Because download pages and build systems still publish MD5. It is fine for spotting a truncated transfer and broken for anything an attacker would gain from faking. Use SHA-256 for that.
Are the digests the same as openssl?
Yes. SHA-1, SHA-256, SHA-384, SHA-512 and MD5 follow the same standards, so a digest here matches sha256sum or shasum on the same bytes.
Does a trailing newline change the digest?
Yes. A hash covers exact bytes. A text file saved with a final line break hashes differently from one without it, which is the most common checksum mismatch people meet.
Is the token signature verified?
No. The page decodes the header and the payload and shows the signature as text. Verifying needs the issuer's key, and a decoder that pretends to verify is worse than one that says it does not.
Can I use it offline?
Yes. Load the page once and keep the tab, or save it to disk. Nothing on it needs the network after the files have arrived.
Which algorithm should I use?
SHA-256 for almost everything. SHA-512 where the platform prefers it, SHA-384 where a TLS suite asks. MD5 and SHA-1 only to compare against a checksum that already exists.