Every algorithm, every folder, every check. Verify a file against a digest you were given, or seal the result in a signed PDF anyone with a Mac can check.
HashLume computes and verifies cryptographic hashes (and the CRC32 checksum) for files and
whole folders, and explains what it is doing while it does it.
WHAT IS FREE
Everything except one thing. All seven algorithms — MD5, SHA-1, SHA-256, SHA-384, SHA-512,
SHA3-256 and CRC32 — run on single files or on entire folder trees, free, with no limits and no
trial period. Verification against a digest you were given is free. Importing a checksum
manifest and verifying every file it names is free. Exporting your results as a spreadsheet, a
shasum-format manifest or a hashdeep audit file is free. The history is free. So is the
teaching material described below.
The one paid feature is the Sealed Certificate: a signed PDF record of your results, $9.99
once, no subscription. You never need it to hash anything.
BUILT TO BE LEARNED FROM
HashLume was written for a classroom as much as for a lab bench.
• Hashing, in plain terms — a glossary of the fifteen words that trip people up, in ordinary
English.
• Try it yourself — flip a single bit of a filename and watch about half the digest change; run
every algorithm against its published test vector (RFC 1321, FIPS 180-4, FIPS 202 and the
standard CRC-32 check value); and watch the app find two different filenames that share a
CRC32, live, in a few seconds.
• Every verdict says what it does and does not establish. A match proves the bytes are
identical. It does not prove where a file came from, and the app says so on screen.
THE SEALED CERTIFICATE
The certificate is a PDF listing each file, its size, its timestamps and every digest computed,
with the examiner and organisation you set in Settings and a space for a signature. It is
signed with a P-256 key held in your Mac's keychain, and it ships with a companion .pem
containing the exact signed bytes and the openssl commands to check them. Anyone with a Mac can
verify it without installing anything:
openssl dgst -sha256 -verify pubkey.pem -signature sig.der manifest.bin
The signature proves the record has not changed since HashLume signed it. It is self-signed and
it does not establish who you are or when you signed — the certificate states that plainly on
its own face, because a document that overclaims is worse than none.
ZERO TELEMETRY
No crash logs, usage data, file names or digests are ever transmitted to ProfWorkBench. No
analytics, no crash reporting, no accounts. The app contains no networking code of its own; the
only network it uses is Apple's own App Store, to ask whether you own the certificate unlock.
Your files are read where they sit and are never uploaded.
ACCESSIBILITY
Controls are reachable from the keyboard and named for VoiceOver, text and colour meet WCAG AA
contrast in both light and dark appearance, state is never signalled by colour alone, and the
app honours Reduce Motion and offers its own switch for it.
Requires macOS 14 or later.
Ratings & Reviews
This app hasn’t received enough ratings or reviews to display an overview.
HashLume 2.0.
EVERYTHING IS FREE EXCEPT THE CERTIFICATE
All seven algorithms, folder hashing, verification, manifest import and every export format are
now free with no limits. The one paid feature is the Sealed Certificate, $9.99 once. If you
already bought the unlock, nothing changes and nothing is taken away: if you bought HashLume
Lifetime, you already own the Sealed Certificate.
FOLDER DIGESTS YOU CAN REPRODUCE
A folder's digest is now computed from a shasum-format manifest, so anyone can recompute its
SHA-1 and SHA-2 digests with the tools already on their Mac — and the Sealed Certificate prints
the command. The previous method was HashLume's own, in no standard format, and gave two
folders the same digest when their files merely traded names.
NEW: HASHING, IN PLAIN TERMS
A glossary of the words that trip people up, written in ordinary English, in the Help menu.
NEW: TRY IT YOURSELF
Three things you can run and watch: flip one bit and see half the digest change; check every
algorithm against its published test vector; and find a real CRC32 collision live on your own
Mac in a few seconds.
THE CERTIFICATE, VERIFIABLE BY ANYONE
Every certificate now ships with a companion .pem holding the exact signed bytes and the
openssl commands to check them, plus a seal over the PDF page itself so the document and the
record can be proved to belong together.
ACCESSIBILITY
A VoiceOver pass: controls named, every table cell spoken with its units, contrast measured on
rendered pixels in both appearances, and an in-app Reduce Motion switch.
Version 2.0
The developer, ProfWorkBench, LLC, indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .
Data Not Collected
The developer does not collect any data from this app.
Privacy practices may vary, for example, based on the features you use or your age. Learn More
The developer indicated that this app supports the following accessibility features. Learn More