toolbox.app
Zero Data Retention

Hash and Checksum Generator

Files never leave your browser.

Hash text or a file with five algorithms at once, compute HMACs, and paste a published checksum to confirm a download, all with the browser's built-in Web Crypto.

Zero retention: your data never leaves this browser. Verify it yourself in DevTools

Loading the toolbox.

About 2hash

How Can You Verify That Nothing Leaves This Browser?

You do not have to take our word that your data stays here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.

  1. Open your browser developer tools with F12, or Cmd+Option+I on a Mac, and select the Network tab.
  2. Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your data.
  3. Click the clear icon in the Network tab so that the log is empty.
  4. Use the tool with your own input.
  5. Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and the tool keeps working.

Only two things can add a line to that log, and neither carries your data. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.

The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint, so a coding mistake could not quietly send your data elsewhere.

What Is a Hash Function?

A cryptographic hash function turns any input into a fixed-length fingerprint. The same input always gives the same digest, a one-bit change gives a completely different one, and it is infeasible to work backwards or to find two inputs with the same digest. That makes hashes the standard way to check that a download arrived intact and was not tampered with.

2hash computes SHA-1, SHA-256, SHA-384, and SHA-512 with crypto.subtle.digest, the browser's native implementation. Web Crypto has no MD5, so 2hash includes a small byte-by-byte MD5, tested against Node's output at every padding boundary.

Which Algorithm Should You Use?

  • SHA-256: the default for checksums, signatures, and content addressing.
  • SHA-384 and SHA-512: longer digests, often faster than SHA-256 on 64-bit hardware.
  • SHA-1 and MD5: broken. Researchers have produced real collisions for both. Use them only to match a legacy checksum, never to protect anything.

Hashes are not for passwords. Store passwords with a slow, salted function such as Argon2id, scrypt, or bcrypt, which a fast hash is designed not to be.

How Large a File Can You Hash?

Up to 1 GB, and the page says so before you pick one. The browser's digest API is not streaming, so the whole file must be in memory at once. The original 2hash claimed to read in chunks but then read the file twice and turned it into a text string for MD5, which failed well below that size. This version reads the file once and runs MD5 over the bytes in place, with a progress bar. For larger files, sha256sum or shasum -a 256 in a terminal is the right tool.

What Is an HMAC?

An HMAC mixes a secret key into the hash, so only someone with the key can produce or check the value. Webhook providers sign each payload with HMAC-SHA-256 and send the result in a header; your server recomputes it with the shared secret and rejects mismatches. 2hash computes HMAC-SHA-256, 384, and 512 so you can compare against what your code produces.

What Other Tools Are in the Encode / Crypto Lane?

  • 2base: Binary, octal, decimal, hex, and any base to 36, with a clickable bit grid and two's complement.
  • 2otp: Live RFC 6238 codes from a pasted secret or otpauth URI. The secret stays in this tab's memory.

Elsewhere in the toolbox: 2uuid, 2gitignore, 2csp, 2htaccess, and more on the 2toolbox home page. Part of the 2suite.io privacy-first ecosystem.

Frequently Asked Questions

Is my file uploaded?

No. The file is read into this tab's memory and hashed there. Turn on offline mode after the page loads and it still works.

Why is MD5 still offered?

Many older downloads publish only an MD5 or SHA-1 checksum. Matching it is still useful for catching corruption, though not tampering.

Why does my hash differ from another tool?

Usually line endings or a trailing newline. 2hash hashes exactly the UTF-8 text you typed.

Can a hash be reversed?

No. Short or common inputs can be guessed by trying candidates, which is why passwords need slow, salted hashing.

Was this helpful?