Hash Generators, Checksums & File Verification: The Complete Guide
Every file you download, every software update you install, and every message you send relies on a quiet mathematical workhorse: the hash function. A hash function takes input of any size — a three-letter word or a four-gigabyte disk image — and squeezes it down into a short, fixed-length fingerprint called a hash, digest or checksum. The same input always produces exactly the same fingerprint, while changing even a single character produces a wildly different one. That simple property makes hashes one of the most useful tools in computing, powering everything from download verification to blockchain networks.
This guide explains what hash generators do, how the five most common algorithms differ, how to verify a file's checksum step by step, how to identify an unknown hash from its length alone, and — just as importantly — where hashes should not be trusted. By the end, you will know exactly which algorithm to reach for and which mistakes to avoid.
What exactly is a hash function?
A cryptographic hash function is a one-way mathematical transformation with four essential properties. First, it is deterministic: hashing the same data twice gives the same result every time. Second, it is fixed-size: no matter how large the input, the output is always the same length — 32 hexadecimal characters for MD5, 64 for SHA-256, 128 for SHA-512. Third, it exhibits the avalanche effect: flipping one bit of input changes roughly half the output bits, so similar inputs produce completely unrelated hashes. Fourth, it is one-way: given only a hash, there is no practical way to reconstruct the original input.
Two further properties matter for security. Collision resistance means it should be infeasible to find two different inputs that produce the same hash. Preimage resistance means that given a target hash, it should be infeasible to find any input that produces it. When an algorithm loses collision resistance — as MD5 did in 2004 and SHA-1 did with Google's SHAttered attack in 2017 — it can no longer be trusted wherever an attacker might benefit from forging a matching fingerprint.
The five algorithms, explained
MD5 produces a 128-bit digest shown as 32 hexadecimal characters. Designed in 1992, it is extremely fast and still ubiquitous in legacy systems, but it is cryptographically broken: researchers can deliberately generate two different files with the identical MD5 hash. It remains perfectly fine for non-adversarial jobs such as detecting accidental corruption, identifying duplicate files, or generating cache keys — anywhere speed matters and nobody is trying to cheat.
SHA-1 produces a 160-bit digest (40 hex characters). It was the dominant standard for more than a decade — Git still uses it for commit identifiers — but practical collision attacks have been demonstrated, so it is deprecated for security use. You will still encounter SHA-1 checksums published alongside older software releases; treat them as weak evidence, not proof.
SHA-256 produces a 256-bit digest (64 hex characters) and is the current gold standard for general use. It secures Bitcoin, TLS certificates, software distribution channels and countless APIs. No practical attack against SHA-256 is known, and cryptographers consider it safe for the foreseeable future. When in doubt, SHA-256 is the algorithm you should choose.
SHA-384 produces a 384-bit digest (96 hex characters). It belongs to the same SHA-2 family as SHA-256 but truncates the output of the SHA-512 computation, giving a larger security margin. You will mostly meet it in enterprise certificate infrastructure and government compliance contexts that mandate longer digests.
SHA-512 produces a 512-bit digest (128 hex characters) — the largest output of the five, and therefore the largest safety margin. Counterintuitively, it is often 20–30% faster than SHA-256 on modern 64-bit processors, because its internal operations are natively 64-bit. Choose SHA-512 when you want maximum assurance or when benchmarking shows it is faster on your hardware.
Checksums: verifying that a download is intact
The most common everyday use of a hash generator is checksum verification. When you download an operating-system ISO, a firmware update, or any large installer, the vendor publishes a checksum — usually SHA-256 — next to the download link. After downloading, you compute the hash of your copy and compare the two strings character by character. If they match exactly, the file arrived intact and unmodified. If they differ, the download is corrupt or has been tampered with, and you should delete it and re-download from an official mirror.
This matters because downloads can be corrupted by flaky networks, interrupted transfers, or failing storage — and, more seriously, because attackers occasionally compromise download mirrors to distribute malware disguised as legitimate software. A checksum comparison is a thirty-second habit that defeats both problems at once, provided you fetch the published checksum from the vendor's official site (ideally over HTTPS) rather than from the same mirror as the file.
HexSum streamlines this workflow: drop the file into the tool, let it compute all five digests, then paste the vendor's published checksum into the verdict box. HexSum detects which algorithm the checksum uses from its length and immediately reports MATCH or MISMATCH — no manual string comparison, no squinting at 64-character strings.
Identifying an unknown hash by its length
Hashes frequently appear without labels — in a database column, a log file, a bug report, or a CTF challenge. Because each algorithm has a fixed output size, the length of the hexadecimal string is a reliable first clue. Count the characters: 32 means MD5 (128 bits), 40 means SHA-1 (160 bits), 64 means SHA-256 (256 bits), 96 means SHA-384 (384 bits), and 128 means SHA-512 (512 bits).
There are caveats worth knowing. A 32-character hash could also be NTLM (the Windows password hash, which is MD4-based) or another 128-bit construction — length narrows the field but does not prove the algorithm. Salted or iterated password hashes look different again: strings beginning with $2y$ or $2b$ are bcrypt, $6$ indicates SHA-512-crypt, and $y$ marks yescrypt. HexSum's identifier handles the five common unsalted digests and tells you the bit length and security status of each, which covers the vast majority of checksums you will meet in the wild.
Hashing text vs. hashing files
Hashing text is straightforward, but one subtlety trips people up: encoding. A hash is computed over bytes, not characters, so the same text hashed as UTF-8 versus UTF-16 produces different digests. HexSum always encodes text as UTF-8 — the web's universal standard — so its results match the echo -n "text" | sha256sum output on Linux and macOS. Watch out for trailing newlines: many command-line tools add one, which changes the hash, so HexSum hashes exactly the characters you provide, nothing more.
Hashing files introduces a performance question. Loading a multi-gigabyte file into memory at once can freeze a browser tab, so HexSum reads files in 4 MB chunks, feeding each chunk into the hash state incrementally and showing a progress bar. MD5 and SHA-1 use built-in pure-JavaScript implementations (browsers' Web Crypto API does not provide them), while SHA-256, SHA-384 and SHA-512 use the browser's native, hardware-accelerated cryptography. Everything happens locally — your files are never uploaded anywhere, which is also why the tool keeps working if you go offline after the page loads.
Where hashes shine — and where they don't
Beyond download verification, hashes quietly power modern computing. Data deduplication systems hash file chunks to spot identical data without comparing entire files. Content-addressed storage — used by Git, Docker image layers and IPFS — names objects by their hash, so identical content is stored once and any corruption is instantly detectable. Digital signatures hash a document first and sign the short digest rather than the whole file. Commitment schemes let someone prove they knew a value at a certain time by publishing its hash, revealing the value later. And blockchains chain blocks together with hashes so that altering history would require recomputing everything after it.
The most important "don't" concerns password storage. A plain SHA-256 hash of a password is dangerously inadequate: it is unsalted, so every user with the password "letmein123" shares the identical hash, and it is blindingly fast — a single GPU can try billions of candidates per second, and precomputed rainbow tables crack common passwords instantly. Proper password storage requires a dedicated password-hashing function — bcrypt, scrypt or Argon2id — which is intentionally slow, automatically salted, and memory-hard to defeat parallel hardware. If you are building a login system, reach for one of those, never for a raw hash function. HexSum's security panel exists precisely to make this distinction impossible to miss.
Practical tips for working with hashes
A few habits will save you headaches. Compare hashes programmatically or with a verifier rather than by eye — humans are terrible at spotting a single changed character in a 64-character string, which is why HexSum's verdict box exists. Normalize before comparing: strip whitespace and line breaks, and treat uppercase and lowercase hex as equivalent (HexSum does both automatically). Prefer SHA-256 for new checksums you publish; it is universally supported and trusted. Keep MD5 only for non-security fingerprints such as ETags, cache keys and duplicate detection. And remember that a hash verifies integrity, not authenticity: a matching checksum proves the file wasn't altered in transit, but only a digital signature — or fetching the checksum over a trusted channel — proves it came from who you think it did. For authenticity guarantees, keyed constructions like HMAC (a hash combined with a secret key) are the right tool, and they underpin webhook signature verification at companies like Stripe and GitHub.
Whether you are verifying an ISO before installing it, fingerprinting data for deduplication, debugging a hash that appears in a log, or simply curious what your name looks like as SHA-512, HexSum gives you all five industry-standard digests in one click — free, unlimited, and entirely private.
Frequently Asked Questions
Is HexSum free, and do I need to sign up? +
Yes. HexSum is completely free with unlimited usage. There is no signup, no account, no paywall and no watermark. Everything runs in your browser, so there is nothing to pay for and nothing to register.
Are my files or text uploaded to a server when I hash them? +
No. HexSum computes every hash locally in your browser using the Web Crypto API and built-in JavaScript. Your text and files never leave your device. You can even disconnect from the internet after the page loads and hashing will keep working.
How do I verify a downloaded file's checksum with HexSum? +
Drop the downloaded file into HexSum, wait for the five hashes to appear, then paste the checksum published by the software vendor into the verdict box. HexSum auto-detects the algorithm from the hash length and shows a MATCH or MISMATCH verdict. A match means the file arrived intact; a mismatch means it is corrupt or has been tampered with.
Which hash algorithm should I use: MD5, SHA-1, SHA-256, SHA-384 or SHA-512? +
For anything security-related, use SHA-256 or SHA-512. MD5 and SHA-1 are broken for security purposes and should only be used for non-security checksums such as detecting accidental corruption or identifying duplicate files. SHA-256 is the modern default; SHA-512 offers the largest security margin and is often faster on 64-bit hardware.
Can I use a plain SHA-256 hash to store passwords? +
No. Plain SHA-256 is far too fast to be a safe password hash and offers no salt, so identical passwords produce identical hashes that are trivially crackable with GPUs and rainbow tables. Use a dedicated password-hashing function such as bcrypt, scrypt or Argon2id, which are intentionally slow and include automatic salting.
How does HexSum identify an unknown hash algorithm? +
HexSum looks at the length of the hexadecimal string. A 32-character hash is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Paste any hash into the Identify tab and HexSum reports the most likely algorithm, its bit length and a security note.