What is a hash value?
What a hash value is, how it is calculated, what it can prove and what it cannot.
By Vladimir Lorentz | Last updated: 4 November 2026
A hash value is a short, fixed-length string calculated from the entire contents of a file by a hash function such as MD5 or SHA-256. It works like a fingerprint: the same file always produces the same hash value, and changing even one byte produces a completely different one. It is usually written in hexadecimal, for example d41d8cd98f00b204e9800998ecf8427e, which happens to be the MD5 of an empty file.
The fingerprint idea
A fingerprint identifies a person without containing the person. You cannot rebuild someone from a fingerprint, but if two prints match you know you are looking at the same finger. A hash value does the same for data. A 4 GB video and a one-line note both reduce to a code of the same length, and that code says nothing readable about what is inside. What it does tell you, very reliably, is whether two files are exactly the same.
That is why the words checksum, digest and fingerprint keep turning up next to "hash": they all describe this one short value that stands in for a much larger file when the only question is "is this the same thing?".
A worked example
Below are two pairs of almost identical inputs. In each pair a single character differs, once with MD5 and once with SHA-256. You can reproduce every line yourself, for example with printf 'hello world' | md5sum on Linux.
One character changed and nothing in the result is recognisable. That is the point: a hash cannot tell you how similar two files are, only whether they are identical. Note the lengths too. MD5 is always 32 hexadecimal characters and SHA-256 always 64, whatever the size of the input.
How a hash function calculates it
To a hash function a file is just a sequence of bytes. Whether those bytes are a photo, a PDF or a spreadsheet makes no difference. MD5, SHA-1 and SHA-256 all follow the same broad pattern:
- Pad the input so its length is a multiple of the block size (64 bytes for MD5 and SHA-256, 128 bytes for SHA-512). The original length is written into the padding, so two inputs that differ only by trailing zero bytes still hash differently.
- Process one block at a time. Each block is mixed into an internal state through many rounds of additions, rotations and logical operations: 64 rounds for MD5 and SHA-256, 80 for SHA-1 and SHA-512.
- Carry the state forward. The state left by one block is the starting point for the next, so every byte of the file influences the final result.
- Output the final state as the digest: 128 bits for MD5, 256 bits for SHA-256, written as hexadecimal text.
Because the work happens block by block, a file never has to be held in memory all at once. That is how a browser can hash a multi-gigabyte video: it reads the file in chunks, feeds each chunk to the function and keeps only the small internal state between them.
Four things that are always true
- 1 Fixed length. An empty file and a 50 GB archive produce a hash of exactly the same length for a given algorithm.
- 2 Deterministic. The same bytes always give the same hash, on any machine and in any program. The file name, date and folder are not part of the contents and do not affect it.
- 3 One-way. You cannot reconstruct a file from its hash. A 32-character value is far too small to contain a document, let alone a video.
- 4 Avalanche effect. Changing one bit of the input changes, on average, about half the bits of the output, as the example above shows.
What hash values are used for
- ›Checking a download. A publisher lists the hash of a file; you calculate it yourself and compare. If they match, you have the file they published, not a damaged or substituted copy. The download verification guide walks through it.
- ›Checking a copy or backup. Hash the original and the copy. Equal sizes can hide a corrupted block; equal hashes cannot. To check two files side by side, use compare files.
- ›Finding duplicates. Files with the same contents have the same hash whatever they are called, so duplicates can be found without opening each one.
- ›Showing that nothing changed. Record a hash today and recalculate it later; a match shows the file is the same. Audit trails and digital evidence rely on this, and a hash report or hash value certificate is the written record of it.
- ›Password storage. Systems keep a hash of a password rather than the password itself, but with deliberately slow algorithms such as bcrypt or Argon2, not the fast file-hashing algorithms discussed here.
The algorithms you will meet
"The hash value" of a file only means something together with the algorithm that produced it. The same file has a different MD5, SHA-1 and SHA-256, and those values cannot be compared with each other.
- ›MD5, 32 characters. Fast and still everywhere, but collisions can be manufactured, so it only reliably shows accidental change. See the MD5 calculator.
- ›SHA-1, 40 characters. Practically broken since the 2017 SHAttered collision; still found in older systems and in Git. See the SHA-1 calculator.
- ›SHA-256, 64 characters, and its larger sibling SHA-512 (128 characters). The usual choice today for downloads, certificates and evidence. See the SHA-256 calculator.
- ›BLAKE2b, a newer design that is fast in software and has no known practical attack.
Which one to use depends mostly on what the hash will be compared with. The guide to choosing an algorithm covers that decision, including MD5 vs SHA-256.
What a hash value does not tell you
- ×It is not encryption. Encryption is reversible with a key and hides contents. A hash is irreversible and identifies contents; it cannot be "decrypted". To keep a file private, encrypt it instead.
- ×It does not protect the file. Anyone who can read a file can calculate its hash. The hash only lets you notice a change afterwards.
- ×It does not prove who made the file. A match proves two copies are identical, not where they came from. Authorship needs a digital signature, or a hash obtained from a source you already trust.
- ×It does not mean the file is safe. A download that matches its published hash is unmodified, not virus-free. If the publisher's file was malicious, so is your copy.
- ×It does not measure similarity. A photo that was resized, or a PDF that was re-saved, has a completely different hash even though it looks the same. Recognising look-alike images is a separate technique called perceptual hashing.
Hash, checksum, digest, fingerprint
In everyday use these words mean the same thing. If you want the distinction: a digest is the formal term for the output of a cryptographic hash function; a checksum originally meant a much simpler error-detection value such as CRC32, which catches accidents but not deliberate changes; fingerprint is an informal description. When a download page says "checksum" today it almost always means a cryptographic hash such as SHA-256.
Try it on your own files
The properties above are easiest to believe once you have seen them for yourself:
- Save a short text file, hash it, add a single space and hash it again. The two values share nothing.
- Hash the same file twice, or on two different computers. The value is identical every time.
- Copy a file and rename the copy. Both hash the same, because the name is not part of the contents.
- Download a program whose publisher lists a SHA-256 and check that your copy matches.
The calculator runs in your browser, so the files you try stay on your device.
FAQ
How do I find the hash value of a file?
Open the hash calculator, select the file and press calculate; the file is read by your browser and not uploaded. On the command line you can use certutil -hashfile FILE SHA256 on Windows, shasum -a 256 FILE on macOS, or sha256sum FILE on Linux.
Can two different files have the same hash value?
In principle yes, because unlimited inputs map to a limited number of outputs; this is called a collision. With MD5 and SHA-1, collisions can be deliberately manufactured. No SHA-256 collision has ever been found, so a SHA-256 match means the files are identical for any practical purpose.
Is a hash value the same as encryption?
No. Encryption is reversible with the right key and its purpose is to hide contents. Hashing is deliberately irreversible and its purpose is to identify contents. A hash cannot be decrypted back into the file.
Why is my hash value different from the one published?
Usually one of three reasons: you used a different algorithm than the one published, the download is incomplete or corrupted, or the file is not the same one. Check the algorithm first. An MD5 is 32 characters and a SHA-256 is 64, so the length tells you straight away.
Does renaming or moving a file change its hash?
No. The hash covers only the bytes inside the file. Renaming, moving or copying it leaves the hash unchanged. Opening and re-saving it in an editor usually does change it, because most programs rewrite the file.