SHA256 Online · Privacy

Privacy

How local hashing protects text, files, HMAC keys, filenames and expected digests.

Data handling in detail

Local processing

Effective 24 October 2026. Selected files are read through browser File and Blob APIs in 2 MiB chunks. Text is decoded and hashed in a local worker. There is no upload endpoint or remote calculation.

File contents are never placed in the page DOM. Text, filenames, paths, HMAC keys, actual digests, expected digests and manifest entries stay in the local tool workspace, which is masked from Clarity recordings and heatmaps. Clear releases active workers and removes displayed inputs; leaving the page releases its task.

Network, scripts and storage

The browser downloads this site’s own HTML, JavaScript and icons. A hosting provider can receive ordinary page-request metadata such as IP address and user agent. Tool calculations run on your device, not on our host.

Microsoft Clarity runs on every page, including the homepage and text and file tools, to collect usage information, session recordings and heatmaps. The entire tool workspace is marked for masking, including text inputs, HMAC keys, expected values, results, filenames, file-selection areas, manifests and error messages. File contents never enter the DOM. Google Analytics runs only on About, Contact, Privacy and Terms and counts a site_visit event with an enumerated page_kind; advertising signals and automatic page views are disabled. Tool events are not sent to Google Analytics. These services receive normal connection metadata and may use their own identifiers. Masking tool content does not hide page visits or interactions; do not put private data in any page URL.

Google AdSense loads on every page, including tool and documentation pages, to support advertising. Google and its partners may use cookies and other identifiers to deliver, measure and personalize advertising, and receive connection metadata such as IP address, browser information and page visits. Learn how Google uses information at https://policies.google.com/technologies/partner-sites and manage advertising preferences at https://myadcenter.google.com/.

Only the chosen light/dark theme is stored in localStorage. Inputs never become share URLs or saved browser state. Downloaded reports are saved locally by your browser. Links to external references use a no-referrer policy. Analytics and advertising scripts contact their providers when pages load.

Practical questions

Are selected file contents sent to a server?

No. File and Blob APIs read chunks in a browser worker. There is no upload endpoint or remote hashing request.

Are filenames transmitted by verification?

No. Filenames and manifest entries are compared in memory. They can appear in the local report you choose to download.

Where is my HMAC key saved?

It stays in memory for the current task. It is not written to localStorage, a share URL or a downloaded report.

What is stored in localStorage?

The tool stores only the light/dark theme preference. Inputs, digests and expected values are never saved. Microsoft Clarity on all pages may use its own identifiers.

Can the host see that I opened a page?

Ordinary page requests can expose IP address, user agent and the requested path to the hosting provider. Local hashing does not remove normal website request metadata.

Does the page use analytics or replay?

Microsoft Clarity runs on every page, with the tool workspace masked from recordings and heatmaps. Google Analytics runs only on About, Contact, Privacy and Terms. Google AdSense also loads on every page; see Network, scripts and storage above.

What happens when I download a report?

Your browser saves a locally generated text file. It may contain sensitive filenames and digests, so manage the downloaded file yourself.

What does Clear remove?

It stops the active worker and clears the tool’s current inputs and displayed results. It does not erase files or reports you already saved on your device.

How Google uses information from partner sites · Google Privacy Policy · Advertising preferences