are my files uploaded?

no. hashing happens with the browser's built-in crypto engine on your device. even multi-gigabyte files never leave your computer.

is sha-256 still safe?

yes. there is no known practical way to craft two different files with the same sha-256 hash. it is the standard for download verification everywhere.

the publisher only lists md5 / sha1 - now what?

those are broken for security purposes. treat md5-only releases as a bad sign and prefer sources that publish sha-256.

home / tools / sha256 checksum

sha-256 checksum

hash any text or local file with sha-256 using your browser's native crypto engine. the classic use: compare a downloaded file (tor browser, tails image...) against the checksum its publisher announced - one different character means a tampered file.

javascript is off - pressing "hash text" will compute the hash on our server instead (processed in memory during that one request, never stored or logged). hashing files, however, needs javascript - that part always runs on your device.

pick what to hash

where should this run?

local · in your browser most private - nothing leaves your device. needs javascript. server · on our machine works without javascript. processed in memory during this one request - never stored or logged.

javascript is off: the local option is unavailable - your request runs on our server instead. it is processed in memory during this one request and never stored or logged.

hash updates automatically while you type. encoding: utf-8.

with javascript on this never leaves your browser.

sha-256 hash

verify like a pro

download the file from the official source.
find the official sha-256 checksum on the same site - the tor project lists it per download ("checksum" / sig details), tails publishes a signed checksum next to each usb image. even better: a checksum inside their pgp-signed release notes.
hash the file here and compare character by character (all 64) - or paste both hashes into our text diff and let it spot the difference for you.
match? you hold exactly the bytes the publisher signed off. mismatch? do not open it.

faq

are my files uploaded?: no. hashing happens with the browser's built-in crypto engine on your device. even multi-gigabyte files never leave your computer.
is sha-256 still safe?: yes. there is no known practical way to craft two different files with the same sha-256 hash. it is the standard for download verification everywhere.
the publisher only lists md5 / sha1 - now what?: those are broken for security purposes. treat md5-only releases as a bad sign and prefer sources that publish sha-256.