File Hash Checker — Verify MD5, SHA-1 & SHA-256
Drop any file here, or
Files are read on your device — nothing is uploaded.
Drop in a file and get its MD5, SHA-1, and SHA-256 checksums in one pass. Paste the hash published on the download page and the tool tells you straight away whether the two agree, so you can confirm an installer or an ISO arrived intact and untampered. The file is read in 4 MB slices inside your browser — nothing is uploaded, so a 6 GB disk image is no more of a problem than a text file.
How it works
- 1 Add the file you downloaded Drop it on the box or click to choose it. Nothing is sent anywhere — the file is read straight off your disk in slices, and the percentage counts up as it goes.
- 2 Paste the published checksum Copy the hash from the project's download page, its SHA256SUMS file, or the release notes into the checksum field. The length tells the tool which algorithm you pasted, so there is nothing to select.
- 3 Read the verdict A green Match means the file is byte-for-byte identical to the one the publisher hashed. A red mismatch means it is not — re-download it and check again before running anything.
- 4 Or just copy a hash With no checksum pasted, the tool works as a plain generator: all three digests appear next to the filename with a copy button each. Drop several files in to hash them one after another.
Your data stays private
All processing happens entirely in your browser. No files, text, or data are ever sent to our servers. You can disconnect from the internet and this tool will still work.
Frequently asked questions
- What does a file checksum actually prove?
- It proves the bytes you have are the exact bytes the publisher hashed. A single flipped bit in a 5 GB ISO produces a completely different SHA-256, so a match rules out a truncated download, a corrupted disk write, and a file swapped in transit. It does not prove the publisher is trustworthy — only that you got what they published.
- Which algorithm should I compare against?
- Whichever one the publisher gave you. SHA-256 is the modern default and the only one worth relying on for security. MD5 and SHA-1 are still published widely — Apache mirrors, older Linux distros, firmware archives — and remain perfectly good for spotting accidental corruption, which is why all three are shown here.
- MD5 is broken — why is it still here?
- Collision attacks against MD5 mean an attacker can craft two different files with the same MD5, so it is useless as a defence against tampering. Detecting a bad download is a different job: random corruption will not accidentally land on a colliding hash. If a vendor only publishes MD5, checking it is still far better than checking nothing.
- Is there a file size limit?
- No. The file is hashed in 4 MB slices and only one slice sits in memory at a time, so multi-gigabyte ISOs and disk images work on an ordinary laptop. Expect roughly 20–60 seconds per gigabyte depending on your CPU; the counter next to the filename shows progress.
- Does my file get uploaded?
- No. The hashing runs in JavaScript on your machine using the File API — there is no server side to this tool at all. Load the page, pull your network cable, and it still works. That matters when the file you are verifying is a backup, a keystore, or a client's document.
- Which formats does the checksum field accept?
- Paste a bare hash, a full sha256sum line like "e3b0c442… *ubuntu.iso", or Windows certutil output with its spaces between byte pairs. The hash is pulled out of whatever you paste and case is ignored, so uppercase hex from certutil compares fine against lowercase hex from Linux.
- How do I get the same hash on the command line?
- On Linux run sha256sum file.iso, on macOS shasum -a 256 file.iso, and on Windows PowerShell Get-FileHash file.iso -Algorithm SHA256. All three print the identical digest this tool shows — handy if you want to double-check the tool itself.
- The hashes match but Windows still warns about the file. Why?
- SmartScreen and Gatekeeper check code-signing certificates and reputation, not checksums. An unsigned installer from a small project will be flagged even when its SHA-256 is perfect. The two checks answer different questions: the hash says the download is intact, the signature says who built it.
- Can I check several files at once?
- Yes. Drop in a whole folder's worth and they are hashed one after another, each with its own row of digests. With a checksum pasted, the file that matches gets the green badge — a quick way to find which of five downloads is the one a release page listed.