What is a hash?
A cryptographic hash function turns any input, from a single word to a large file, into a short, fixed-length fingerprint. The same input always gives the same hash, and changing even one character gives a completely different one. For example, the SHA-256 hash of hello starts 2cf24dba…, butHello starts 185f8db3….
Verify a download
- Find the checksum on the publisher’s download page. It is often labelled SHA-256 or “checksum”.
- Choose Hash a file and select the file you downloaded, or drop it onto the box.
- Paste the published checksum into Compare with a checksum. You will see which algorithm matches, or a warning if none do.
The comparison ignores letter case, spaces and colons, and accepts labels like sha256: in front of the hash.
The algorithms
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128 bits (32 hex) | Legacy checksums only. Not secure. |
| SHA-1 | 160 bits (40 hex) | Legacy systems and Git object IDs. Not secure. |
| SHA-256 | 256 bits (64 hex) | The default choice: checksums, signatures, integrity checks |
| SHA-384 | 384 bits (96 hex) | Subresource Integrity, TLS, higher security margins |
| SHA-512 | 512 bits (128 hex) | High security margins; often faster than SHA-256 on 64-bit computers |
SHA hashes are calculated with your browser’s built-in Web Crypto API. MD5 is not included in Web Crypto because it is insecure, so NiftyKit calculates it with its own tested implementation.
Limitations
- Files up to 1 GB are supported, depending on your device’s memory, because the whole file is read at once.
- SHA-3, BLAKE and keyed hashes (HMAC) are not offered yet.
Frequently asked questions
Which hash should I use?
Use SHA-256 unless something specific requires another algorithm. It is fast, widely supported and secure. MD5 and SHA-1 are broken for security purposes, because attackers can create two different files with the same hash, but they are still fine for spotting accidental corruption and for working with older systems.
Can I use these hashes to store passwords?
No. Plain hashes like SHA-256 are designed to be fast, which makes guessing passwords fast too. Store passwords with a slow, salted password-hashing function such as Argon2id, scrypt or bcrypt, using a maintained library.
Why does my hash not match the one on the download page?
Check that you are comparing the same algorithm: a SHA-256 checksum will never match an MD5 hash. If the algorithm matches and the hash still differs, the file is not identical to the one the publisher hashed. It may be incomplete, corrupted or tampered with, so download it again from the official source.
Can a hash be reversed to get the original text?
No. A hash is a one-way fingerprint. However, short or common inputs can be found by guessing, so a hash of something like a phone number or a simple password does not keep it secret.