File checksum (MD5 / SHA)
Compute a file's hashes to verify a download hasn't been tampered with. No upload
Click to choose or drag & drop a file
Any file type
How to use the file checksum tool
- Drop in a file — any type, from a downloaded installer to a ZIP or ISO. It's read locally, never uploaded.
- All four digests are computed at once: MD5, SHA-1, SHA-256 and SHA-512, each shown as lowercase hex with its own Copy button.
- To verify a download, paste the publisher's hash into Compare to a known hash — you don't need to know which algorithm it is; the tool matches it against all four automatically, ignoring case.
- A green “✓ Matches SHA-256” (or whichever algorithm hit) means the file is byte-for-byte what the publisher hashed; “✕ No match” means it isn't — re-download before assuming worse.
- To compare two local files, hash each in turn and compare any one digest — identical SHA-256 means identical files.
Common uses
- Verify a downloaded installer or ISO against the checksum on the project's site — Linux images, for example, ship with a SHA256SUMS file for exactly this.
- Confirm a large file survived a transfer intact: hash it before uploading to cloud storage or copying to a USB drive, and again on the other side.
- Prove two files are byte-for-byte identical without opening them — renamed duplicates hash the same, and a single changed byte changes everything.
- Publish a checksum next to a file you distribute so recipients can verify their copy.
- Match a vendor's legacy MD5 manifest — plenty of firmware and driver downloads still publish MD5 sums.
Tips & limitations
- Paste the expected hash first if you like — the comparison re-runs automatically when the file finishes hashing, and the matching row lights up.
- A matching checksum proves integrity, and only against the value you compared with. If an attacker controls the download page, they can swap both file and hash — when it matters, get the expected hash from a second source.
- Treat MD5 and SHA-1 as legacy: collisions can be manufactured for both, so use them only to match old published values. For anything security-relevant, compare SHA-256 or SHA-512.
- The whole file is loaded into memory to hash it — hundreds of MB is fine on a desktop, but multi-GB files can be slow or fail on phones and low-RAM machines. There's no streaming mode.
- MD5 comes from a small library loaded from a CDN; if your network blocks it, MD5 shows as unavailable while the SHA family (built into the browser) still works.
How it's built & why it's safe
The file is read locally into an ArrayBuffer, then hashed two ways: SHA-1, SHA-256 and SHA-512 by the browser's native crypto.subtle.digest() (Web Crypto), and MD5 by the spark-md5 JavaScript library, since browsers don't ship MD5. Comparison against a pasted hash is a case-insensitive string match across all four results. Nothing is uploaded — the only thing fetched over the network is the MD5 library itself, and your file never leaves your device.
Related tools: Hash Generator · One Time Link · Diff Checker
Further reading: Checksums: how to verify a downloaded file is genuine
Frequently asked questions
What does a checksum actually prove?
That two copies of a file are byte-for-byte identical. If your computed hash equals the publisher's, your download wasn't corrupted or altered in transit; if even one byte differs, the hash changes completely. It says nothing about whether the file is safe to run — only that it's the file that was hashed.
Which algorithm should I compare?
Whichever the publisher lists — the tool matches your pasted value against all four automatically. If you're choosing one yourself, use SHA-256: it's the current standard, universally supported, and has no known practical attacks.
Is MD5 still okay to use?
For integrity checks against accidental corruption, yes — and you'll still meet it in older manifests. But collisions can be deliberately constructed for MD5 (and SHA-1), so a match is not proof against a motivated attacker. Prefer SHA-256 whenever both sides can use it.
Is my file uploaded to hash it?
No. The file is read and hashed entirely in your browser using the Web Crypto API — nothing is transmitted, so it's fine to checksum confidential documents. This also means speed depends on your device, not a server.
How large a file can it handle?
The file is read fully into memory, so the practical ceiling is your device's RAM — hundreds of megabytes is comfortable on a desktop, while multi-gigabyte ISOs may be slow or fail, especially on mobile. For huge files, a command-line tool like sha256sum streams and is faster.
Why doesn't my hash match the published one?
Usually the download is incomplete or a different version than the page describes — re-download and check the version number first. Case doesn't matter (the comparison is case-insensitive), but stray spaces or a filename pasted along with the hash will prevent a match.