File Checksum
How to use
Computes the SHA-256 and SHA-1 checksums of any file directly in your browser, so you can verify a download has not been corrupted or tampered with. Upload a file and optionally paste a checksum to compare against for an instant match/mismatch check.
Select File
- Verifying an OS ISO or software installer against the publisher's posted checksum before running it
- Confirming a large file transfer completed without corruption
- Checking that a file hasn't been modified since it was originally shared
- Comparing two copies of the same file to confirm they are byte-for-byte identical
What a matching hash proves, and what it does not
A cryptographic hash reduces a file of any size to a fixed-length fingerprint, and changing a single bit anywhere in the file changes roughly half the output bits. That is what makes comparison useful: if the hash you compute matches the one the publisher listed, the bytes you hold are the bytes they hashed. A truncated download, a corrupted transfer or a silently failing disk all change the hash, and all become immediately visible.
What a match does not establish is who produced the file. If an attacker controls the page serving both the download and the published hash, they can replace both and the check passes perfectly. The checksum proves integrity, the file was not damaged in transit, and says nothing about authenticity. Answering "did the right party publish this" requires a cryptographic signature verified against a key you obtained independently, which is why distributions publish signed hash files rather than bare hashes on a web page.
Choice of algorithm follows from that distinction. MD5 and SHA-1 remain perfectly good at detecting accidental corruption and are fast, but both have practical collision attacks: an adversary can construct two different files with the same hash, so neither should be relied on where someone might deliberately try. SHA-256 is the correct default and the one publishers overwhelmingly list. Hashing here happens through the browser's own Web Crypto implementation, reading the file from your disk: the file is never uploaded, which is the whole reason it is reasonable to check a confidential archive this way.
Free and private. Everything runs on your own device, with no account and no uploads.
Verifying a downloaded file has not been corrupted or tampered with requires comparing checksums. This tool computes SHA-256 and SHA-1 checksums of any file directly in your browser.
A mismatch usually means the file was corrupted during download, or in rare cases, tampered with, always re-download from the original source if checksums don't match.
SHA-256 is stronger and preferred when available; SHA-1 is still commonly published by some sources but is considered weaker for security-critical verification.
Yes. Paste the value from the download page into the compare box. It is checked against both the SHA-256 and the SHA-1 result, ignoring capital letters and spaces at either end, so you do not need to know which of the two the site published.
MD5 is broken for this purpose: two different files with the same MD5 can be produced deliberately, so a matching MD5 shows a download was not corrupted in transit but not that it is genuine. This tool uses only the hashing built into the browser, which does not include MD5. If a site publishes only an MD5, ask for SHA-256.
- 1
Upload your file
Select the file you want to verify.
- 2
View the computed checksums
SHA-256 and SHA-1 hashes are calculated automatically.
- 3
Compare against the published value
Paste the checksum you were given to get an instant match/mismatch check.
- ·Always compare against a checksum published on the vendor's official site, not one bundled with the file itself.
- ·Prefer SHA-256 over SHA-1 whenever the publisher offers both.
- ·A checksum match confirms integrity, not safety, a corrupted-but-malicious file can still have a valid published hash if the source itself was compromised.