HashLume
Hash it. Verify it. Know exactly what it proves.
Hash and verify files and whole folders on your Mac. Hashing, verifying and exporting are free. The Sealed Certificate, a self-signed PDF record, is an optional purchase.
MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256 and CRC32, computed together in one pass. CRC32 is a checksum, not a cryptographic hash.
One row per file, plus the folder’s own digest. Anyone can recompute the folder’s SHA-1 and SHA-2 digests with the shasum command already on a Mac. Files whose names begin with ._ and drives mounted inside the folder are left out.
Paste a digest you were given, or check a shasum, sha256sum, BSD or hashdeep manifest file by file. A SHA-2 or SHA-3 match shows the bytes are identical. An MD5 or SHA-1 match cannot prove that on its own, and no match shows where a file came from.
Export a spreadsheet (CSV), a manifest for shasum -c, or a hashdeep audit file. The History keeps your newest 1,000 entries.
A glossary of hashing terms and a lab, Try it yourself: flip one bit and watch about half the digest change, run each algorithm against its published test vector, and watch a CRC32 collision being found.
An optional purchase. A PDF record of what was hashed, signed with a key kept in your Mac’s keychain, with a .pem file and openssl commands so anyone with a Mac can check it. It is self-signed: it proves the record has not changed since sealing, not who made it, when, or where the files came from. It is not certified by any authority.
HashLume’s only outside connection is Apple’s App Store (StoreKit). It contacts the App Store only about the Sealed Certificate: to show it, and when you buy or restore it. That connection is on by default and cannot be switched off, and the traffic goes to Apple. No crash logs, usage data, file names or digests are sent to ProfWorkBench, and there are no analytics, accounts or ads. Files are opened read-only and never uploaded, and the app runs in the macOS App Sandbox, so it can read only what you choose or drop on it. The Terms, Privacy and Report a Bug links open in your own browser.
Free to download. The Sealed Certificate is one payment of US$9.99, with no subscription, and prices vary by storefront. It is self-signed: it proves the record has not changed since it was sealed, not who made it, when, or where the files came from.
Educational, military, and first-responder discounts apply; see Academic & Service Discounts.