Checksum Verifier

Hash a file and compare the result with the checksum its publisher printed.

Runs on your deviceSecurity & PrivacyWorkingNo account needed

What this tool does

Checksum Verifier reads the bytes of the file you choose, computes a digest, and compares it character for character with the value you paste. SHA-256, SHA-384, SHA-512 and SHA-1 are computed by the browser's own Web Crypto implementation; MD5 has no Web Crypto equivalent, so it is computed here in JavaScript over four-megabyte chunks. The verdict is a plain MATCH or MISMATCH, with both digests shown so you can see exactly what differed.

The expected value does not have to be a bare hex string. A line copied from a .sha256 or SHASUMS file works, so does a label such as "SHA256: …" pasted out of a release page, and so does a Subresource Integrity value in the sha256-<base64> form used in script tags. Upper-case digests are accepted. When the pasted text lists several files, the line whose filename matches the file you added is the one used — which means you can paste a whole SHASUMS file once, add several downloads, and each is checked against its own line.

Nothing is transmitted. The file is read by this browser tab, hashed there, and the digest never leaves the page — which is why the tool keeps working with the network disconnected, and why it is safe to verify a download you have not yet decided to trust. Leaving the expected field empty computes the digest instead, using the algorithm you picked, or SHA-256 when Auto is left in place. With Auto, the algorithm is deduced from the length of the hash you pasted: 32 hex characters means MD5, 40 SHA-1, 64 SHA-256, 96 SHA-384, 128 SHA-512. Choosing an algorithm that contradicts that length is refused before any hashing starts, rather than quietly producing a mismatch.

Two constraints are worth spelling out. Web Crypto has no streaming interface, so a SHA digest needs the whole file in memory at once; past roughly 2 GB the job is refused with a message pointing you at a desktop tool such as sha256sum or certutil. MD5 is chunked and has no such ceiling, but it is the weaker choice for every other reason. The deeper limit is what a checksum proves: that the bytes you hold match the hash you pasted, and nothing more. If the hash came from the same page as the download, whoever could replace one could replace the other. A checksum catches a truncated transfer, a corrupted disk and a bad mirror; only a signature check against a key you already trust catches a deliberately substituted file.

How to use it

  1. Add the file. Any file type, and any size for MD5; SHA hashing stops near 2 GB. Add several at once and each is hashed in turn, matched to its own line when the expected value is a SHASUMS list.
  2. Paste the expected checksum. A bare hex digest, a line from a SHASUMS file, a "SHA256: …" label, or an SRI value. Leave it empty to just compute the digest instead of verifying one.
  3. Leave the algorithm on Auto, or pick one. Auto reads the algorithm from the length of the hash you pasted, and falls back to SHA-256 when the field is empty. Pick one explicitly only when you know which the publisher used.
  4. Read the verdict. MATCH or MISMATCH, with the computed digest, the expected value and the file size listed beneath. MD5 and SHA-1 results carry a note that they are not collision-resistant.
  5. Keep the report if you want a record. The optional .txt output records the filename, size, algorithm, both digests and the result, and is named after the file — installer.iso becomes installer.sha256.txt.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Verify downloaded installers and ISOs

Distributions and desktop apps publish a digest beside the download precisely so a half-finished transfer or a stale mirror is caught before you run the file.

Confirming a large transfer arrived intact

Hash the file before it goes to a NAS, an external drive or a colleague, hash the copy afterwards, and compare the two digests.

Checking an SRI value before self-hosting a script

Paste the sha256- value from the vendor's script tag and hash your local copy of the library to confirm you saved the same build.

Auditing a long-term archive

A backup that has sat on a drive for years may have rotted silently. A stored digest is the only cheap way to find out which files changed.

Reproducing someone else's build

When a project publishes the digest of its release artefact, hashing your own build output shows immediately whether it came out byte-identical.

Questions

Is the file uploaded anywhere?
No. The digest is computed in this browser tab using the Web Crypto API, or in JavaScript for MD5. Nothing about the file is transmitted or stored, and the page continues to work offline.
What can I paste as the expected value?
A hex digest on its own, a line from a .sha256 or SHASUMS file including the filename, a labelled form such as "SHA256: …", or an SRI value like sha256-<base64>. Hex digests are read in either case, though an SRI value needs its sha256- prefix in lower case. If the text lists several files and none is named like yours, it says so rather than guessing.
What does a MISMATCH actually mean?
That the bytes you have are not the bytes the publisher hashed. Far and away the most common causes are an interrupted download and a mirror serving an older release, so re-download from the primary source and check again before assuming anything worse.
Does a match mean the file is safe?
It means the file is the one that hash describes. If you took the hash from the same page as the download, that page vouching for itself is all you have proved. Use a signature verified against a key you already hold when the integrity of the source itself is in question.
Should I trust an MD5 or SHA-1 checksum?
They are fine for catching accidental corruption, which is what most published checksums are for, and the result carries a note saying so. Neither is collision-resistant, so prefer SHA-256 whenever the publisher offers both.
How large a file can it handle?
MD5 is hashed in chunks and has no fixed limit. The SHA algorithms go through Web Crypto, which has to hold the whole file in memory, so files beyond about 2 GB are refused with a suggestion to use sha256sum or certutil locally.
How is this different from Hash Generator or File Hash Compare?
Hash Generator digests text you type. File Hash Compare hashes a set of files and groups the identical ones without any published value. Checksum Verifier is for the case where someone else has given you the hash you are checking against.

Related tools

  • Protect PDF — Add a password and set permissions on a PDF.
  • Sign PDF — Draw, type or upload a signature and place it on the page.
  • Hash Generator — Compute MD5, SHA-1, SHA-256 and SHA-512 digests.
  • Password Generator — Generate strong passwords with rules you control.
  • Redact PDF — Permanently remove sensitive content, not just cover it.
  • Remove PDF Metadata — Strip identifying metadata before you share a file.