Identify a file by its magic bytes and flag extensions that lie about the real format.
New
File Hash Calculator
Runs locallyNew
Use File Hash Calculator
What it does
Drop one or more files to get their MD5, SHA-1 and SHA-256. Hashing happens in your browser; only the lookup links you click send a hash to VirusTotal or MalwareBazaar.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Published test sentence
The quick brown fox jumps over the lazy dogexample.txt
43 B (43 bytes) · browser type text/plain
Done
MD5
9e107d9d372bb6826bd81d3542a419d6
SHA-1
2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
SHA-256
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
VirusTotal ↗
MalwareBazaar ↗
These links open virustotal.com or bazaar.abuse.ch in a new tab and send only the SHA-256, never the file.Hashed as a 43-byte file named example.txt: MD5 9e107d9d372bb6826bd81d3542a419d6, SHA-1 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12 and SHA-256 d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592, the published values for this sentence.
FAQ
Which hashes does the calculator produce, and how?
MD5 comes from this page's own RFC 1321 implementation while the file is read in 4 MB slices; SHA-1 and SHA-256 come from the browser's Web Crypto API. All three cover the exact bytes of the file, so they match what sha256sum, Get-FileHash or VirusTotal report for it.
Why are SHA-1 and SHA-256 missing for very large files?
Web Crypto can only hash a complete buffer, so the page would have to hold the whole file in memory; above 500 MB it skips them to keep the tab from crashing and computes only MD5. MD5 and SHA-1 are fine for lookups but not collision-resistant, so quote the SHA-256 when you report a sample.
Is the file uploaded to VirusTotal or MalwareBazaar?
No. The file never leaves your browser. The VirusTotal and MalwareBazaar buttons are ordinary links that open those sites in a new tab with the hash in the address, and nothing is sent until you click one.