What is the difference between a checksum and a hash (checksum vs hash)?

A hash is a fixed-size mathematical digest produced by a cryptographic hash function (such as SHA-256 or SHA-512) engineered to be one-way and collision-resistant against intentional tampering. A checksum is an error-detecting code (such as CRC-32 or simple parity sums) designed primarily to detect accidental transmission errors or storage corruption. All cryptographic hashes can serve as checksums, but simple non-cryptographic checksums cannot provide security against deliberate tampering.

What is HMAC and how is it different from a standard hash?

A standard hash (such as SHA-256) takes only data as input and produces a fixed digest. An HMAC (Keyed-Hash Message Authentication Code, RFC 2104) combines the data with a secret cryptographic key using a two-pass hash construction. This proves both data integrity and sender authenticity, preventing attackers from modifying payloads or generating valid signatures without the secret key.

How do I sign webhook payloads or verify HMAC signatures?

Switch to the HMAC Key tab, paste your raw request body payload, and enter your webhook secret key. The tool computes HMAC-SHA256, HMAC-SHA512, and HMAC-MD5 digests in lowercase hex, uppercase HEX, and Base64 format, matching the verification headers used by GitHub (X-Hub-Signature-256) and Stripe (Stripe-Signature).

How do I check a file checksum on Windows 10 without installing software?

Windows 10 includes two native command-line utilities. Using Command Prompt, run: certutil -hashfile "filename.ext" SHA256 (or replace SHA256 with MD5). Using PowerShell, run: Get-FileHash -Path "filename.ext" -Algorithm SHA256. PrivaUtils generates these exact CLI commands with one-click copy buttons for your uploaded files.

Are my files, passwords, or text payloads uploaded to any remote server?

No. PrivaUtils runs inside your browser memory using the W3C Web Cryptography API (window.crypto.subtle). File bytes are read through browser FileReader buffers in local device RAM without network requests.

Why is SHA-256 preferred over MD5 and SHA-1?

MD5 (128-bit) and SHA-1 (160-bit) have demonstrated practical collision attacks where two different inputs yield identical hashes. They are cryptographically broken for digital signatures and authentication, though still used for rapid error checking. SHA-256 (256-bit) remains mathematically secure with no known collision vulnerabilities.

How do I download a .sha256 or .md5 file for my downloads?

Select the Export & Download options box and click .sha256 file or .md5 file. The browser generates standard GNU coreutils checksum files formatted as ' ', ready for automated verification via 'sha256sum -c'.

How does PrivaUtils save tool settings?

Preferences such as default mode, output case, visible algorithms, and salt strings are saved locally to your browser IndexedDB under the 'hash-generator-settings' key. You can review, delete, or export your saved configuration in the Storage Vault anytime.

WebCrypto W3C • FIPS 180-4

Security

Hash & Checksum Generator

WebCrypto W3CFIPS 180-4CRC-32 & MD5

Zero cloud uploads: hardware WebCrypto execution with automatic pure-JS fallbacks.

Format:

Normalize CRLF to LF

Source Payload(59 bytes)

Execution: 0.05ms

Hardware Acceleration (W3C WebCrypto + Pure JS Fallbacks)

Compare & Verify Checksum

Real-Time Verification

Export & Download OptionsTarget: payload.txt

Local Verification Commands

Windows 10 / 11 CertUtil

certutil -hashfile "payload.txt" SHA256

Linux / macOS sha256sum

sha256sum "payload.txt"

Computed Checksums0 algorithms

Feature Comparison & Security Audit

How PrivaUtils Compares to 10015.io, AllInOne.tools & All-Free-Tool

Many web hash utilities upload files to backend cloud servers, limit file sizes, omit modern 64-bit algorithms, or lack checksum export files. Here is the verified capability matrix:

Capability / Feature	PrivaUtils	10015.io	allinone.tools	all-free-tool
Zero Server Uploads (100% Client RAM)	Yes (WebCrypto API)	Yes	Server API Upload	Client-side basic
Simultaneous Multi-Hash Calculation	6 Algos (SHA-256, 512, 384, 1, MD5, CRC-32)	4 Algos	Single algorithm	Single algorithm
File Checksum Hashing Size Limit	Up to 2GB in memory	Text only / Small files	50MB limit	10MB limit
Live Compare & Match Verification	Yes (Auto-algorithm detection + match badge)	Basic compare	No	No
Multi-Format Checksum Export (.sha256, .md5, BSD, JSON, CSV)	Yes (6 download formats + coreutils ready)	No	No	No
CLI Command Generators (certutil, sha256sum)	Yes (Windows 10, PowerShell, Linux)	No	No	No
HMAC Key Signing (RFC 2104)	Yes (HMAC-SHA256, 512, 384, 1, MD5)	Separate tool	No	No
Persistent IndexedDB Storage Vault	Yes (Save, Apply, Reset, JSON export)	No	No	No

Checksum vs Hash: Understanding the Difference

While developers often use the terms interchangeably, checksums and cryptographic hashes serve distinct engineering objectives:

Checksum (Error Detection)

A checksum is calculated to detect accidental data corruption during file transmission, storage degradation, or network packet drops. Examples include CRC-32 and Adler-32. Checksums are fast and computationally lightweight, but they are not collision-resistant. An attacker can easily craft a modified file that yields the exact same CRC-32 checksum.

Primary use: ZIP archives, Ethernet packets, PNG chunk validation.

Cryptographic Hash (Security & Integrity)

A cryptographic hash function maps arbitrary binary inputs to fixed-size bit strings with strict mathematical guarantees: pre-image resistance (impossible to reverse), second pre-image resistance (impossible to find an alternate input with the same hash), and collision resistance (computationally infeasible to find any two colliding inputs).

Primary use: Software releases, TLS certificates, Git commit IDs, blockchains.

How to Check File Checksums on Windows 10 & 11

Windows includes built-in command-line tools to verify file integrity without downloading unverified third-party software:

Method 1: Command Prompt (cmd.exe) via CertUtilAll Windows versions

Open Command Prompt, navigate to the folder with your download, and run:

certutil -hashfile "installer.exe" SHA256

To check an MD5 checksum instead, replace SHA256 with MD5: certutil -hashfile "file.zip" MD5.

Method 2: PowerShell via Get-FileHashPowerShell 5.1+

Open Windows PowerShell and run the native Get-FileHash cmdlet:

Get-FileHash -Path "installer.exe" -Algorithm SHA256 | Format-List

Supported algorithms for Get-FileHash include SHA1, SHA256, SHA384, SHA512, and MD5.

How to Verify File Checksums on Linux and macOS

Linux distributions and macOS include standard core utilities. To check a downloaded file against a vendor-supplied checksum string:

Linux (Ubuntu, Debian, Fedora, Arch):

sha256sum "filename.iso"

macOS (Terminal):

shasum -a 256 "filename.dmg"

Automated Verification with .sha256 File:

sha256sum -c filename.sha256

HMAC Signatures: Webhook Authentication and RFC 2104

A Keyed-Hash Message Authentication Code (HMAC) combines a cryptographic hash function with a secret key. This structure verifies both the authenticity and the integrity of data in transit.

Why Standard Hashes Fall Short

A plain hash function takes only payload bytes as input. If an attacker intercepts a message, they can alter the payload and calculate a new valid hash. Merely prepending a secret key to data before hashing (such as Hash(key + message)) is vulnerable to length extension attacks in Merkle-Damgard hash algorithms like SHA-256 and SHA-512.

Vulnerability: Length extension attacks allow adversaries to append data without knowing the key.

How HMAC Solves the Problem

RFC 2104 and FIPS 198-1 define HMAC with two nested hashing passes: H((K ^ opad) || H((K ^ ipad) || message)). This nested design prevents length extension attacks. Because only the sender and recipient possess the shared secret key K, third parties cannot forge a valid signature.

Standard implementation: Supported across SHA-256, SHA-512, SHA-384, SHA-1, and MD5.

Common Webhook Verification Formats

GitHub Webhooks (X-Hub-Signature-256):

sha256=HMAC_SHA256(webhook_secret, raw_json_payload)

Stripe Webhooks (Stripe-Signature):

t=timestamp,v1=HMAC_SHA256(endpoint_secret, timestamp + "." + raw_payload)

AWS Signature Version 4 (SigV4):

HMAC_SHA256(kSigning, string_to_sign)

Zero-Knowledge Client Architecture via W3C WebCrypto

PrivaUtils relies on the W3C Web Cryptography API (window.crypto.subtle) natively implemented in Chrome, Firefox, Safari, and Edge. All cryptographic transformations occur inside your operating system kernel and CPU registers (using Intel SHA extensions or ARMv8 Crypto instructions). No bytes leave your device, eliminating data breach risks when handling sensitive source code, passwords, or confidential documents.

Frequently Asked Questions

What is the difference between SHA-256 and SHA-512?

SHA-256 outputs a 256-bit (32-byte) digest using 32-bit arithmetic. SHA-512 outputs a 512-bit (64-byte) digest using 64-bit internal operations. On modern 64-bit desktop and server CPUs, SHA-512 frequently executes faster per byte than SHA-256 while providing double the collision resistance headroom.

Can I calculate checksums for large files like Linux ISOs or game archives?

Yes. Files up to 2 gigabytes are processed directly in browser memory using streaming FileReader buffers. Calculation speed is limited only by your computer disk read speed and processor hardware capabilities.

How do I compute HMAC signatures for webhook authentication?

Switch to the HMAC Key tab. Enter your payload in the input box and type or generate your secret key in the HMAC Secret Key field. The tool computes HMAC-SHA256, HMAC-SHA512, and HMAC-MD5 digests formatted for GitHub webhooks, Stripe signatures, and AWS SigV4 headers.

How do I save and restore my preferred settings?

Click Settings in the toolbar to configure your default mode, encoding, visible algorithms, and salts. Click Save & Apply to store your preferences in your browser IndexedDB vault under the 'hash-generator-settings' key. You can view, export, or clear these settings in the Storage Vault anytime.