Help

User guide for HashCalc Pro on macOS®. Last updated: April 24, 2026.

• Getting started
• Input modes
• Choosing algorithms
• Reading results and Find hash
• Hex output formatting
• HMAC
• Saving and verifying .hash sidecar files
• VirusTotal lookups
• Getting a free VirusTotal API key
• Tabs overview
• Tips and shortcuts
• Troubleshooting

Getting started

HashCalc Pro computes cryptographic and non-cryptographic hashes for files, text, and raw hex data. Open the app and you'll land on the Main tab, which is where all hashing happens.

1. Pick an input - drop a file onto the window, use the file picker, type text, or enter a hex byte string.
2. Choose which algorithms you want (or leave the defaults).
3. Click Calculate.

All hashing runs locally on your Mac. Nothing is uploaded anywhere. The only network request HashCalc ever makes is a VirusTotal hash lookup you explicitly trigger.

Input modes

HashCalc supports three input modes, selectable from the input area on the Main tab:

• File. Pick a file using the file browser or drag and drop it directly onto the window. Large files are streamed in 8 MB chunks with a live progress bar and a Stop button, so you're never stuck waiting without feedback.
• Text. Type or paste a plain text string into the input field. The text is hashed as-is (UTF-8 encoded).
• Hex. Enter a raw hexadecimal byte string (for example 48656c6c6f). Useful when you need to hash an exact byte sequence rather than a text interpretation.

Choosing algorithms

The result grid lists all 48 supported algorithms. Each one has a toggle; enabled algorithms are computed when you click Calculate. A sensible default set is already enabled.

• Toggle individually by clicking any algorithm's checkbox.
• Shift-click any toggle to flip the entire default set on or off at once - handy when you want everything or nothing as a starting point.

All enabled algorithms are computed in a single streaming pass over the input. Adding more algorithms doesn't cost an extra disk read; the file is read once and every hasher is updated from the same buffer.

Reading results and Find hash

After calculation, each enabled algorithm shows its hex digest in the result grid. You can:

• Click a result row to copy that digest to the clipboard.
• Use the Find hash field above the grid to search by algorithm name or by a run of hex digits. This is particularly useful when you have a known digest and want to check whether it appears among the 48 rows, or when you just want to jump to a specific algorithm quickly.

Hex output formatting

Results are displayed in hexadecimal and you can control the exact format from the Options tab under Hash output:

• Letter case: all upper, all lower, high-nibble upper (Ab), or low-nibble upper (aB).
• Byte layout: plain, colon-separated, comma + space, C-style { 0x.., 0x.. }, array [0x.., 0x..], or custom.
• Custom layout: define a prefix and suffix that wrap the whole digest, plus a per-byte prefix, separator, and suffix. This means you can produce output ready to paste directly into code, a CI manifest, or documentation without manual reformatting.

HMAC

HMAC (Hash-based Message Authentication Code) lets you combine a secret key with a hash to produce a keyed digest. This is used to verify both the integrity and authenticity of a message - only someone with the same key can produce or verify the same HMAC output.

• Enter your HMAC key in the key field on the Main tab.
• HMAC is supported on algorithms that define it: the MD family, SHA-1/2/3 families, RIPEMD, Tiger, Whirlpool, Panama, and BLAKE2b.
• You can optionally save the key to the macOS Keychain so it persists across sessions. The saved key is scoped to HashCalc's bundle identifier and stored as a generic-password Keychain item.
• When a .hash sidecar is written with HMAC active, the sidecar stores a key fingerprint (not the key itself) so later verification can confirm you're using the same secret.

Saving and verifying .hash sidecar files

After computing hashes, click Write to save a .hash sidecar file. This JSON file records:

• The algorithm → hex digest map for every enabled hash in that run.
• An HMAC key fingerprint (when HMAC was active).
• Generator metadata: app version, build, timestamps.
• A portable, tilde-abbreviated source path (for example ~/Desktop/file.txt).

By default, the sidecar is saved next to the source file. You can set a dedicated output folder in Options → Hash files folder.

Verifying a sidecar

To verify a file against a previously saved sidecar:

1. Drag the .hash file onto the HashCalc window, or use the Verify button.
2. HashCalc switches into verify mode, re-reads the original source file, recomputes every stored hash, and reports per-algorithm match or mismatch.
3. If the original source can't be found at the stored path (for example because you moved it or are on a different Mac), HashCalc prompts you to locate it.

VirusTotal lookups

HashCalc can query VirusTotal using a computed hash to check whether the file has known detections across dozens of antivirus engines. This is a hash-only lookup - only the SHA-256, SHA-1, or MD5 digest is sent over HTTPS. Your file bytes never leave your Mac through this path.

• After calculating hashes, click the VirusTotal button to perform a one-off lookup.
• Results appear as a color-coded toast: green (no risk), amber (low), orange (medium), red (high), deep red (critical).
• The status bar shows a summary like VT Detections: [3/72] → Low Risk.

You can also enable auto-lookup and an optional detections dialog in the Options tab so the query runs automatically after every calculation.

Rate limits

VirusTotal's free community tier is capped at 4 requests per minute and 500 per day. HashCalc enforces these limits locally so you don't accidentally exceed them and get blocked. If you have a paid or organization API key, toggle Use Paid/org VirusTotal account in Options to skip local throttling.

Getting a free VirusTotal API key

VirusTotal offers a free community API key that's sufficient for casual use. Here's how to get one:

1. Go to virustotal.com/gui/join-us and create a free account. You can sign up with an email address or use a Google account.
2. Confirm your email address if prompted.
3. Once signed in, click your profile avatar (top-right corner of the VirusTotal site) and select API key.
4. Your personal API key is displayed on this page. Click the copy icon next to the key to copy it to your clipboard.
5. In HashCalc, go to the Options tab, find the VirusTotal section, and paste the key into the API key field.
6. The key is securely stored in your macOS Keychain - it won't appear in plain-text preferences.

That's it. You can now use the VirusTotal button on the Main tab. For more detail, VirusTotal also has their own guide: Please give me an API key.

If you need higher quotas (more than 4 lookups/minute or 500/day), VirusTotal offers paid plans. Once you have a premium key, enable Use Paid/org VirusTotal account in Options so HashCalc stops enforcing the public rate limits locally.

Tabs overview

• Main - The primary workspace. Source input, HMAC key, algorithm toggles, the result grid with Find hash, progress indicator, and the Calculate, VirusTotal, Write, and Verify buttons.
• Theme - Appearance mode (light, dark, or follow system), font family picker with a search filter over every installed font, font size (11–22 pt), accent color, and primary text color. Both colors have a reset option.
• Options - Behavioral settings: keep window on top, quit-confirmation dialog, .hash output folder, toast message durations, hex output format (letter case, byte layout, custom format), and VirusTotal configuration (API key, auto-lookup, detections dialog, paid account toggle).
• Stats - Cumulative run statistics, real throughput in MB/s, per-algorithm run counts and timings, action tallies (HMAC runs, verifications, VirusTotal lookups, sidecars written, hashes copied), and a time-wasted tracker.
• Credits - Acknowledgments for the algorithms, references, and components used in the app.

Tips and shortcuts

• Drag and drop is the fastest way to hash a file. Drop it anywhere on the HashCalc window.
• Shift-click an algorithm toggle to select or deselect all at once.
• Find hash accepts both algorithm names and hex fragments - paste a known SHA-256 and the grid jumps to it if it matches.
• Keep window on top (Options tab) is useful when you're comparing a hash against a value in another window.
• The time-wasted tracker on the Stats tab tallies how long you've spent hashing. You can show it in the status bar from Options if you want a running reminder.
• Use Delete all Settings at the bottom of the Options tab to completely reset the app to defaults, including removing both Keychain items (HMAC key and VirusTotal API key). Stats are not affected.

Troubleshooting

HashCalc says it can't read my file

HashCalc runs inside the macOS App Sandbox and can only access files and folders you explicitly grant it. If you see a permissions error, try dragging the file directly onto the window or use the file picker. Folder grants persist across launches via security-scoped bookmarks.

Verification says the source file isn't found

When verifying a .hash sidecar, HashCalc tries to locate the original file using the stored path. If you've moved the file, renamed it, or are on a different Mac, HashCalc will prompt you to point at the source manually.

VirusTotal says "rate limit exceeded"

The free community tier allows 4 lookups per minute and 500 per day. If you hit this limit, wait a moment before trying again. HashCalc enforces these limits locally, but if you've used the same key in other tools, the combined total counts against your quota on VirusTotal's side.

VirusTotal says "hash not in database"

Not every file has been scanned by VirusTotal. If the hash isn't in their database, it means nobody has submitted that file for analysis yet. This doesn't mean the file is safe or unsafe - it just hasn't been seen before.

Something else?

Use the support form to report bugs, request features, or ask questions. Include your macOS version and what you were doing in the app when the issue occurred.