Developer Hashing

Checksum calculator

Drop your file here Or tap to choose. Nothing is uploaded.

Algorithm

Drop a file to see its checksum

Expected checksum

Hashed in your browser · the file is never uploaded

Local · the file is read, never sent

A checksum tells you whether the file you have is byte-for-byte the file the publisher released. Compute the hash of your copy, compare it with the one on the download page, and if they match nothing was corrupted or altered in transit.

How to verify a checksum

1 Drop the file in. It is read from disk and hashed in this page.

2 Pick the algorithm the publisher used — usually SHA-256, sometimes SHA-512 or MD5.

3 Paste their published value into the box. A whole line copied from a sha256sum file works; the filename after the hash is ignored.

The reason this has to run locally is not privacy but logic. Uploading a file to a website so that it can tell you the file is genuine puts the website between you and the answer — if it is compromised, or simply wrong, you learn nothing. Hashing in your own browser removes that step. One limitation to be honest about: a checksum only proves the file matches the value you compared against. If an attacker controls the download page, they control the published hash too. That is what signatures are for, and why security-critical releases are signed rather than merely hashed.

Questions

Which algorithm should I choose? −

Whichever the publisher used — the point is comparing like with like. If several are offered, prefer SHA-256.

Can I paste the whole line from a sha256sum file? +

Is there a file size limit? +

The checksums do not match — now what? +

Does the file get uploaded? +

Does a matching checksum mean the file is safe? +

Sources

RFC 1321 — the MD5 message-digest algorithm NIST FIPS 180-4 — secure hash standard MDN — SubtleCrypto.digest()

Was this tool any good?

INTERNAL SIGNAL ONLY · WE USE IT TO FIND TOOLS WORTH REBUILDING