HashLume

Forensic Checksum Analyzer

Only for Mac

Free · In‑App Purchases

Mac

Every algorithm, every folder, every check. Verify a file against a digest you were given, or seal the result in a signed PDF anyone with a Mac can check. HashLume computes and verifies cryptographic hashes (and the CRC32 checksum) for files and whole folders, and explains what it is doing while it does it. WHAT IS FREE Everything except one thing. All seven algorithms — MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256 and CRC32 — run on single files or on entire folder trees, free, with no limits and no trial period. Verification against a digest you were given is free. Importing a checksum manifest and verifying every file it names is free. Exporting your results as a spreadsheet, a shasum-format manifest or a hashdeep audit file is free. The history is free. So is the teaching material described below. The one paid feature is the Sealed Certificate: a signed PDF record of your results, $9.99 once, no subscription. You never need it to hash anything. BUILT TO BE LEARNED FROM HashLume was written for a classroom as much as for a lab bench. • Hashing, in plain terms — a glossary of the fifteen words that trip people up, in ordinary English. • Try it yourself — flip a single bit of a filename and watch about half the digest change; run every algorithm against its published test vector (RFC 1321, FIPS 180-4, FIPS 202 and the standard CRC-32 check value); and watch the app find two different filenames that share a CRC32, live, in a few seconds. • Every verdict says what it does and does not establish. A match proves the bytes are identical. It does not prove where a file came from, and the app says so on screen. THE SEALED CERTIFICATE The certificate is a PDF listing each file, its size, its timestamps and every digest computed, with the examiner and organisation you set in Settings and a space for a signature. It is signed with a P-256 key held in your Mac's keychain, and it ships with a companion .pem containing the exact signed bytes and the openssl commands to check them. Anyone with a Mac can verify it without installing anything: openssl dgst -sha256 -verify pubkey.pem -signature sig.der manifest.bin The signature proves the record has not changed since HashLume signed it. It is self-signed and it does not establish who you are or when you signed — the certificate states that plainly on its own face, because a document that overclaims is worse than none. ZERO TELEMETRY No crash logs, usage data, file names or digests are ever transmitted to ProfWorkBench. No analytics, no crash reporting, no accounts. The app contains no networking code of its own; the only network it uses is Apple's own App Store, to ask whether you own the certificate unlock. Your files are read where they sit and are never uploaded. ACCESSIBILITY Controls are reachable from the keyboard and named for VoiceOver, text and colour meet WCAG AA contrast in both light and dark appearance, state is never signalled by colour alone, and the app honours Reduce Motion and offers its own switch for it. Requires macOS 14 or later.

  • This app hasn’t received enough ratings or reviews to display an overview.

HashLume 2.0. EVERYTHING IS FREE EXCEPT THE CERTIFICATE All seven algorithms, folder hashing, verification, manifest import and every export format are now free with no limits. The one paid feature is the Sealed Certificate, $9.99 once. If you already bought the unlock, nothing changes and nothing is taken away: if you bought HashLume Lifetime, you already own the Sealed Certificate. FOLDER DIGESTS YOU CAN REPRODUCE A folder's digest is now computed from a shasum-format manifest, so anyone can recompute its SHA-1 and SHA-2 digests with the tools already on their Mac — and the Sealed Certificate prints the command. The previous method was HashLume's own, in no standard format, and gave two folders the same digest when their files merely traded names. NEW: HASHING, IN PLAIN TERMS A glossary of the words that trip people up, written in ordinary English, in the Help menu. NEW: TRY IT YOURSELF Three things you can run and watch: flip one bit and see half the digest change; check every algorithm against its published test vector; and find a real CRC32 collision live on your own Mac in a few seconds. THE CERTIFICATE, VERIFIABLE BY ANYONE Every certificate now ships with a companion .pem holding the exact signed bytes and the openssl commands to check them, plus a seal over the PDF page itself so the document and the record can be proved to belong together. ACCESSIBILITY A VoiceOver pass: controls named, every table cell spoken with its units, contrast measured on rendered pixels in both appearances, and an in-app Reduce Motion switch.

The developer, ProfWorkBench, LLC, indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .

  • Data Not Collected

    The developer does not collect any data from this app.

    Privacy practices may vary, for example, based on the features you use or your age. Learn More

    The developer indicated that this app supports the following accessibility features. Learn More

    • Supported Features

      • VoiceOver

      • Dark Interface

      • Differentiate Without Color Alone

      • Sufficient Contrast

      • Reduced Motion

    Seller
    ProfWorkBench, LLC
    Size
    2.5 MB
    Category
    Utilities
    Compatibility
    Requires macOS 14.0 or later.
    • Mac
      Requires macOS 14.0 or later.
    Languages
    English
    Age Rating
    4+
    In-App Purchases
    Yes
    Copyright
    © 2026 ProfWorkBench, LLC