Hash Calculator

How the hash calculator works

A hash function turns any amount of data into a fixed-length digest. Change one bit of the input and the digest changes completely, which is what makes it the standard test of whether two sets of bytes are identical. In digital forensics the digest is taken at acquisition and re-checked afterwards: if it still matches, the exhibit has not altered in handling.

This calculator runs entirely in your browser. Text and files are read locally, hashed with the browser's own Web Crypto implementation for the SHA family, and released from memory when you clear the field. Nothing is uploaded to a server, which matters when the subject is case material. MD5 and CRC32 are not part of Web Crypto, so they are implemented in the tool and checked against published test vectors every time the page loads.

Frequently asked questions

Is my file uploaded anywhere?

No. The file is read from disk by your browser, hashed in the tab, and discarded from memory. There is no upload, no temporary server copy, and no logging of the contents. You can confirm this by watching the network tab while hashing.

Which hash should be used for evidence integrity?

SHA-256 for anything new. MD5 and SHA-1 are both collision-broken, meaning two different files can be constructed to share a digest, so they should only be used to cross-check against older records that were made with them.

What does it mean when two files have the same hash?

With a cryptographic hash it means the two byte streams are almost certainly identical. It says nothing about where either came from, so a matching digest supports continuity of an exhibit but does not by itself prove provenance.

Why is CRC32 included if it is not secure?

CRC32 detects accidental corruption during copying or transfer and appears in ZIP archives and many acquisition logs. It is trivial to forge deliberately, so it is a transfer check rather than an integrity guarantee.

How large a file can be hashed in the browser?

The file is read in 8 MB chunks, but the SHA algorithms need the whole buffer in memory, so practical limits are set by the device. Up to a few hundred megabytes is usually fine; past 512 MB the tool warns you and a desktop utility such as sha256sum or CertUtil is the better choice.

What is in the generated report?

The report ID and timestamp, the subject details including file name, size, MIME type and last-modified date, every digest computed, the verification result if you supplied an expected value, and a method statement recording that hashing was performed locally. It is available as PDF, Word, plain text, CSV and JSON.

Other forensic tools

• SerologyBloodstain Impact AngleCalculate the angle of impact of a blood droplet from its width-to-length ratio.
• BiologyTime Since Death EstimatorEstimate post-mortem interval from body temperature using the Henssge nomogram approach.
• BallisticsBullet TrajectoryReconstruct a shooting angle from entry and reference point measurements.
• ToxicologyWidmark BAC CalculatorEstimate blood alcohol concentration using the Widmark formula for casework context.