Skip to content
Utilboxes

File Checksum Verifier

Add the file you downloaded, paste the publisher's checksum and press Calculate checksums for a clear match or mismatch. MD5, SHA-1, SHA-256 and SHA-512 are computed in one pass at any file size, and the file is never uploaded. Rely on SHA-256: MD5 and SHA-1 catch accidental corruption, not deliberate tampering.

Files never leave your device

Updated

How to use the File Checksum Verifier

  1. 1Add the file you downloaded.
  2. 2Paste the checksum from the download page — the algorithm is detected from its length.
  3. 3Press Calculate checksums.
  4. 4Read the verdict: the checksums either match exactly or they do not.

How it works

A cryptographic hash turns any file into a short fingerprint. Change a single bit anywhere in the file and the fingerprint changes completely, so if the hash of your copy equals the one the publisher printed, your copy is identical to theirs — nothing was corrupted in transit or swapped along the way.

The file is read from your disk in chunks and fed to every selected algorithm at once, so even a multi-gigabyte disk image is read only once and memory use stays flat. The hashing runs as WebAssembly in your browser, and the file is never uploaded — which matters for exactly the files people check, such as installers, backups and disk images.

SHA-256 is the one to rely on. MD5 and SHA-1 still catch accidental corruption, but both are broken against deliberate tampering: it is practical to craft two different files with the same MD5 or SHA-1. When a publisher offers SHA-256 or SHA-512, compare that.

The comparison ignores letter case and surrounding spaces, and accepts the “hash filename” lines written by sha256sum and the “SHA256 (file) = hash” lines written by BSD and macOS tools.

Tips and common mistakes

  • Compare SHA-256 or SHA-512 when the publisher offers them.
  • Take the published checksum from the official site over HTTPS, not from the same mirror the file came from.
  • On a mismatch, download the file again before assuming it was tampered with; interrupted downloads are the usual cause.
  • Paste whole lines copied from a checksum file; the common formats are recognised.

Frequently asked questions

Where do I find the checksum to compare against?
On the download page, in the release notes, or in a file such as SHA256SUMS next to the download. Take it from the publisher's own site over HTTPS — a checksum from the same untrusted mirror as the file proves little.
What does a mismatch mean?
The files are not identical. The download may be incomplete or corrupted, so download it again — or the checksum may be for a different version or file.
Is MD5 still good enough?
For spotting accidental corruption, yes. For proving a file has not been tampered with, no — use SHA-256 or SHA-512 where the publisher provides them.
Is there a file size limit?
No fixed limit. Large files simply take longer — roughly the time your disk takes to read them plus the hashing — while memory use stays the same.
How do I check a checksum without a website?
On Windows, run Get-FileHash file -Algorithm SHA256 in PowerShell. On macOS or Linux, run shasum -a 256 file or sha256sum file in a terminal.
Can two different files have the same SHA-256?
In theory, yes; in practice nobody has ever found two. That is why a matching SHA-256 is treated as proof the file is identical.
Is my file uploaded?
No. It is read in chunks and hashed in your browser.
Share this toolShare on XShare on FacebookShare on LinkedInShare on RedditShare by email

Guide

Related tools

Base64 EncoderEncode text or a file to Base64, standard or URL-safe.UUID GeneratorVersion 4 and version 7 UUIDs, plus NIL and ULID-style output.GeneratorsJSON ValidatorCheck JSON syntax and get a plain-English explanation of errors.URL EncoderPercent-encode a whole URL or a single query parameter.