Practical hash guide · October 18, 2026
Choose a hash for the comparison you actually need
Start with the recipient's algorithm, then distinguish secure digests from fast checksums and password-hashing systems.
For a published reference, compatibility decides
When checking a published download, your choice is already made: use the algorithm that created the published value. Calculating all 26 algorithms cannot turn an MD5-only reference into a SHA-256 reference. Several outputs can be useful when a workflow requests them, but every additional algorithm also performs more computation.
For a new file-integrity record, SHA-256 is a practical default. Store its name alongside the complete digest, filename and version so the record is unambiguous. SHA-512, SHA-3 or a BLAKE-family result is useful when your workflow explicitly requires it. The longest output in the menu is not automatically the best match for another person's tools.
Separate accidental-change checks from hostile modification
CRC, Adler and xxHash serve fast accidental-change or lookup workflows. They are not substitutes for a cryptographic integrity mechanism when an attacker might deliberately modify the data.
MD5 and SHA-1 remain useful for reproducing older references. Their presence in a calculator does not make them suitable choices for a new security-sensitive design. NIST is transitioning away from SHA-1, and Microsoft's Get-FileHash documentation warns against MD5 and SHA-1 when protection against deliberate alteration is needed.
A trusted reference still matters when using a modern algorithm. Hashing can compare bytes, but a digest copied from the same untrusted source as the file does not independently establish the publisher's identity.
A file digest is not a password-storage system
Do not store account passwords by feeding them through a general file-hash calculator. Password handling requires dedicated salted password-hashing schemes and an appropriate authentication system. A fast digest intended for large files solves a different problem.
Keep a file-integrity task narrowly defined: identify the exact bytes, choose the agreed algorithm and compare the complete value. Do not infer encryption, malware scanning or authentication from a generated hash.
Make a large calculation manageable
Begin with only the algorithms you need and keep the tab open until completion. LocalHash reads files in 4 MiB chunks and updates the selected algorithms as those bytes are processed. This avoids creating a single input buffer containing the whole file; it does not mean the entire application uses exactly 4 MiB of memory.
Device speed, browser behavior and the selected algorithms determine practical runtime and memory use. A browser may be unable to start a particular algorithm, in which case check the availability notice instead of assuming that every selected result was generated. Keep a complete local copy if a cloud file provider cannot supply the input reliably.