Image Hash Generator

A cryptographic hash like MD5 or SHA-256 is computed from the exact bytes of the file. Changing a single byte, even something invisible like re-saving the file, produces a completely different hash. A perceptual hash is computed from how the image actually looks, so two images that look nearly identical after resizing or recompression will usually produce very similar perceptual hashes, even though their cryptographic hashes are completely different.

Yes. In Single mode, a Hex or Base64 toggle switches the display format for every cryptographic hash at once, and when Hex is selected, a separate toggle switches between lowercase and uppercase. Batch mode's CSV and JSON exports respect whichever hex case is currently selected too.

Both are fine for checksums, deduplication and confirming a file was not corrupted in transfer, which is what this tool is for. Neither should be used for anything security sensitive like password storage or digital signatures, since both have known collision weaknesses. For security sensitive use cases, SHA-256 or stronger is the standard choice.

Subresource Integrity lets a browser verify that a file it fetched, such as a script, stylesheet or image loaded through fetch with an integrity option, has not been tampered with. It requires the hash in base64 rather than the usual hex format, prefixed with the algorithm name, for example sha384-followed by the base64 string. The Copy SRI button next to SHA-256, SHA-384 and SHA-512 produces that exact format ready to paste into an integrity attribute.

The Verify field only recognizes hex input, it detects the algorithm by counting hex characters, 32 for MD5 up to 128 for SHA-512. An SRI value produced by Copy SRI is base64, not hex, so pasting it into Verify won't be recognized as any algorithm at all. Use Verify with a plain hex hash you were given, and use Copy SRI separately when you specifically need the base64 integrity attribute format.

It always changes the cryptographic hash, even a tiny quality change produces a completely different MD5 or SHA-256. The perceptual hashes usually stay close, often identical or a few bits apart, since they are based on the image's overall appearance rather than its exact encoding. This is exactly why the tool keeps the two categories separate rather than mixing them into one list.

It measures the Hamming distance between each pair of perceptual hashes, meaning how many of the 64 bits differ. A distance of 0 means the perceptual hashes are identical. Up to about 5 bits typically means a near duplicate, such as a recompressed copy. Six to fifteen bits usually still means a visually similar image. Beyond that, the images are generally different. These thresholds are a practical guide rather than an exact science.

Bulk hashing is almost always about confirming exact integrity across many files at once, such as verifying a batch download matched what was expected, which is a cryptographic hash job. Perceptual hashing is comparison work best done one pair at a time in Compare mode, where the result actually means something rather than being a wall of numbers with nothing to compare against.

Perceptual hashing needs the browser to actually decode and render the file as an image, which some browsers can't reliably do for every HEIC or AVIF file depending on their format variant. When that happens, cryptographic hashes still compute normally since they only need the raw file bytes, and a note appears explaining that perceptual hashing wasn't available for that particular file. It isn't a bug, it's a decoding limitation specific to that file and browser combination.

Yes. In Single mode, Download as .txt and Download as .json buttons export every hash for that file at once, including perceptual hashes if they were computed. In Batch mode, Export CSV and Export JSON do the same across every file in the batch, though batch exports only include cryptographic hashes.

There's no hard limit, but a note appears for files over 200MB letting you know hashing may take a moment. This is expected for very large files, not a sign of a problem.

No. Every hash, cryptographic and perceptual, is computed entirely in your browser using the Web Crypto API and the Canvas API. Your image never leaves your device. You can disconnect from the internet after loading the page and the tool still works completely.