HashBolt
Compute MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE3 or CRC-32 for files of any size, or for plain text, and check the result against the checksum a vendor published. The file is streamed inside your browser and never uploaded.
Drop your files here
Any type, any size, as many as you like. Nothing is read until you press Compute.
Tick as many as you need: the file is read once and every digest is computed on that single pass.
Queue a file, tick the algorithms you need and press Compute.
Hex and Base64 both work, in any case. A digest length that no ticked algorithm produces is called out instead of being reported as a mismatch.
How it works
Queue what you want to check
Drop files in, pick a whole folder, paste one, or switch to the text tab. Nothing is read yet.
Pick the algorithms
One or a dozen. They share a single pass over the file, so three digests cost barely more than one.
Press Compute
The file is streamed in chunks inside a worker, so the progress bar is real and a 20 GB image never lands in RAM.
Compare with the published one
Paste a hash or an entire SUMS file. Matching happens by value, not by the way it was printed.
Streams, never swallows
Files are read in chunks inside a worker, so memory stays flat and the progress bar tracks bytes actually hashed. Multi-gigabyte ISOs are ordinary work here.
Twelve digests, one read
MD5, SHA-1, SHA-256/384/512, SHA3-256/512, BLAKE2b, BLAKE3, RIPEMD-160, CRC-32 and xxHash64, all fed from the same pass over the file.
Verification that explains itself
Paste a hash or a whole SHA256SUMS listing. Values are compared across hex and Base64, and a length that belongs to no selected algorithm is named as such rather than called a mismatch.
Folders and batches
Queue a hundred files, hash them one after another, then export a coreutils-compatible SUMS file to publish next to your download.
HMAC and every notation
Keyed HMAC digests plus hex, Base64 and Base64URL output, uppercase and grouped display. Switching any of them re-renders instantly instead of re-reading the file.
Nothing is uploaded
The engine is WebAssembly embedded in the page itself. No CDN call, no API, no upload: pull the network cable after loading and it still works.
Check a download before you trust it
A checksum is the only cheap way to know that the installer you just downloaded is byte for byte the one that was published, and not a truncated transfer or a swapped mirror. HashBolt computes that fingerprint locally: files are streamed through a WebAssembly engine in chunks, so size stops being a limit, and every algorithm you tick is fed from the same read. Then you paste the published value — a bare hash, a SHA256SUMS listing, a BSD-style line — and get a verdict that says which algorithm matched.
A WebAssembly engine in a worker
The hashing runs off the main thread on compiled WebAssembly, an order of magnitude faster than the hand-written JavaScript most online tools still use for MD5. Because it consumes the file as a stream, peak memory is one chunk rather than the whole file, and the interface stays responsive while a 4 GB archive is being read.
What a checksum proves, and what it does not
Verify a Linux ISO or an installer against the hash on the vendor page. Confirm that a file copied to an external drive arrived intact. Spot two identical files under different names by comparing digests instead of opening them. Produce a SUMS file to ship with a release so other people can do the same.
There is no upload endpoint in this tool, and no network request of any kind is involved in hashing: the WebAssembly module is embedded in the page, so it works with the connection switched off. Your files, your text and any HMAC key you type stay in the tab and disappear when you close it.
Frequently asked questions
QIs my file uploaded anywhere?+
No. The hashing engine is WebAssembly embedded in the page and it runs in a worker inside your browser. There is no upload endpoint, no API call and no CDN fetch, so the tool keeps working with the network disconnected.
QHow large a file can it handle?+
There is no fixed ceiling: the file is consumed as a stream in small chunks, so only one chunk is in memory at a time and multi-gigabyte disk images are routine. What limits you in practice is how fast your drive can read, which is what the speed readout shows.
QHow do I verify a downloaded ISO or installer?+
Queue the file, tick the algorithm the vendor used (SHA-256 in almost every case), press Compute, and paste their published value into the verification box. You can paste the whole SHA256SUMS file too — lines are matched to your files by name.
QWhy is MD5 marked with a warning?+
Because building two different files with the same MD5 digest is cheap today, and the same is true of SHA-1. They remain perfectly good at catching a corrupted transfer, which is what a checksum on a download page is usually for, but they prove nothing against someone who tampered with the file on purpose.
QMy hash does not match the one on the website. What now?+
First check you compared the same algorithm: a 64-character hash can be SHA-256, SHA3-256, BLAKE2b or BLAKE3, and the tool tells you which one matched. Then re-download the file — a genuine mismatch is most often an interrupted or mirrored-badly transfer. If it persists with a fresh download, do not run the file.
QWhy does hashing text give a different result to hashing a file with the same text?+
Because a file usually carries something the textarea does not: a trailing newline, Windows CRLF line endings, or a UTF-8 byte order mark. The tool hashes exactly the bytes you gave it, and there is a switch to normalise CRLF to LF when you need to match a value produced on Linux.
QWhat is HMAC for?+
A plain hash proves that content was not altered by accident; anyone can recompute it. An HMAC mixes a secret key into the digest, so only someone holding that key can produce or check the value. It is what API signatures and webhook verification use.