ImgTweak LogoImgTweak
Browse all tools
Image Hash Generator

Image Hash Generator

MD5, SHA-1, SHA-256, SHA-384 and SHA-512, plus perceptual hashing for visual similarity. Verify, compare and batch process. Nothing leaves your device.

5 Algorithms

MD5 to SHA-512

SRI Ready

Copy as Attribute

Perceptual

aHash, dHash, pHash

Private

No Uploads

Drop your image here

JPG, PNG, WebP, GIF, BMP, AVIF, HEIC, TIFF or SVG

Your file never leaves this device

Built for developers, not just a generic hash tool

Every generic checksum tool gives you MD5 and SHA-256. This one is built around what image work actually needs.

Five cryptographic algorithms

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 computed from the raw file bytes, in hex or base64.

Perceptual hashing

aHash, dHash and pHash describe how an image looks, catching near duplicates a byte hash would miss.

SRI-ready output

One click copies SHA-256, SHA-384 or SHA-512 in the exact sha384-base64 format an integrity attribute expects.

Verify against expected

Paste a hash you were given. The algorithm is auto-detected by length and checked instantly.

Compare two images

Check byte-for-byte equality and how visually similar two images are, side by side.

Batch mode

Drop many images at once and export every hash as a CSV or JSON file for your own tooling.

What you can do with this tool

Verify a CDN asset was not tampered with

Hash an image you host and compare it against what you expect, or generate an SRI attribute so the browser checks it on every fetch.

Deduplicate a photo library

Use SHA-256 to find exact duplicate files, then switch to perceptual hashing to catch copies that were resized or recompressed along the way.

Confirm a re-upload is identical

Someone sends you a file again after a bug report. Hash both and know in a second whether anything actually changed.

Catch a recompressed duplicate

Two files with completely different SHA-256 hashes can still be visually the same photo. Compare mode's perceptual distance catches exactly that case.

Bulk checksum a batch download

Drop an entire folder of downloaded images and export every hash as a CSV to check against a manifest.

Reading a perceptual distance

0 bits

Identical, as far as the perceptual hash can tell.

1 to 5 bits

Near duplicate. Usually the same photo, recompressed or lightly re-encoded.

6 to 15 bits

Still visually similar, could be a crop, a filter, or a moderate edit.

16 bits or more

Generally a different image. Treat this as a practical guide, not an exact rule.

Two hashes, two different questions

A cryptographic hash answers one specific question, is this exactly the same sequence of bytes as before. Change a single pixel, resave a JPEG at a slightly different quality, or add one byte of metadata, and MD5 or SHA-256 will come back completely different, with no partial credit and no sense of how close the two files actually are. That is the entire point. A hash that changed gradually as a file changed gradually would be useless for verifying downloads or signing software, since a tiny undetected corruption would slip through unnoticed.

A perceptual hash answers a completely different question, does this look like the same image. It is built by shrinking the photo down to a tiny grid, in some cases as small as 8 by 8 pixels, throwing away the fine detail entirely and keeping only the broad pattern of light and dark. Two photos that started identical and then went through different JPEG compression settings will usually reduce to nearly the same tiny grid, even though every byte of the actual files is now different. That is what makes it useful for catching duplicates that a cryptographic hash would treat as completely unrelated files.

Why MD5 needs its own code while the others do not

Modern browsers include a built-in, hardware-accelerated implementation of SHA-1, SHA-256, SHA-384 and SHA-512 through the Web Crypto API, which is what this tool uses for those four. MD5 is not included. It was formally deprecated from that standard because of well documented collision weaknesses that make it unsuitable for anything security related. Since MD5 checksums are still extremely common in everyday developer workflows, package registries, older systems, quick sanity checks, this tool implements the MD5 algorithm directly rather than leaving it out, while still being upfront that it should never be relied on for anything where security actually matters.

What actually happens when you generate an SRI attribute

Subresource Integrity was designed for the browser to check a fetched file against a hash you provide up front, refusing to use the file at all if it does not match. The format it expects is specific: the algorithm name, a hyphen, then the hash in base64 rather than the hex format most tools default to. That mismatch, hex versus base64, is the most common reason a hand-copied SRI attribute silently fails. The Copy SRI button next to SHA-256, SHA-384 and SHA-512 sidesteps that entirely by producing the exact string the attribute expects, ready to paste. If you are hosting images that other pages fetch and verify, that same hash pairs well with the metadata viewer for confirming exactly what you are shipping.

Frequently asked questions

What is the difference between a cryptographic hash and a perceptual hash?

A cryptographic hash like MD5 or SHA-256 is computed from the exact bytes of the file. Changing a single byte, even something invisible like re-saving the file, produces a completely different hash. A perceptual hash is computed from how the image actually looks, so two images that look nearly identical after resizing or recompression will usually produce very similar perceptual hashes, even though their cryptographic hashes are completely different.

Is MD5 or SHA-1 safe to use?

Both are fine for checksums, deduplication and confirming a file was not corrupted in transfer, which is what this tool is for. Neither should be used for anything security sensitive like password storage or digital signatures, since both have known collision weaknesses. For security sensitive use cases, SHA-256 or stronger is the standard choice.

What is the SRI copy button for?

Subresource Integrity lets a browser verify that a file it fetched, such as a script, stylesheet or image loaded through fetch with an integrity option, has not been tampered with. It requires the hash in base64 rather than the usual hex format, prefixed with the algorithm name, for example sha384-followed by the base64 string. The Copy SRI button next to SHA-256, SHA-384 and SHA-512 produces that exact format ready to paste into an integrity attribute.

Does resizing or compressing an image change its hash?

It always changes the cryptographic hash, even a tiny quality change produces a completely different MD5 or SHA-256. The perceptual hashes usually stay close, often identical or a few bits apart, since they are based on the image's overall appearance rather than its exact encoding. This is exactly why the tool keeps the two categories separate rather than mixing them into one list.

How does the Compare mode decide images are similar?

It measures the Hamming distance between each pair of perceptual hashes, meaning how many of the 64 bits differ. A distance of 0 means the perceptual hashes are identical. Up to about 5 bits typically means a near duplicate, such as a recompressed copy. Six to fifteen bits usually still means a visually similar image. Beyond that, the images are generally different. These thresholds are a practical guide rather than an exact science.

Why does Batch mode only show cryptographic hashes?

Bulk hashing is almost always about confirming exact integrity across many files at once, such as verifying a batch download matched what was expected, which is a cryptographic hash job. Perceptual hashing is comparison work best done one pair at a time in Compare mode, where the result actually means something rather than being a wall of numbers with nothing to compare against.

Is my image uploaded to a server?

No. Every hash, cryptographic and perceptual, is computed entirely in your browser using the Web Crypto API and the Canvas API. Your image never leaves your device. You can disconnect from the internet after loading the page and the tool still works completely.

Related tools

Image Metadata Viewer

View EXIF data, GPS location. Remove metadata.

Image to Base64

Encode to data URI, HTML tag or CSS output.

Compress Under 100KB

Reduce file size for portals and upload forms.

Image SEO Checker

Audit alt text, filenames and image formats.