File Hash Checker

About File hash checker

Downloading software is only safe if the file you received is the file the publisher built. This tool hashes a file on your device with SHA-1, SHA-256, SHA-384 or SHA-512, and if you paste the checksum from the publisher's page it tells you whether the two match, ignoring letter case and separators.

How to use it

1. Pick the algorithm under Hash algorithm to match the checksum you were given. SHA-256 is selected first.
2. Select Choose a file and pick the download. A progress bar shows while it is read and hashed.
3. Paste the published value into Expected hash (optional).
4. Read the verdict: a Match badge, a Mismatch warning, or a message that the pasted value has the wrong length or characters.
5. Toggle Hex or Base64 if you need the digest in the other form, then use Copy.

Verifying a five-byte file

A file containing the letters hello with no trailing newline, SHA-256, expected 2CF24DBA:5FB0A30E:26E83B2A:C5B9E29E:1B161E5C:1FA7425E:73043362:938B9824

Digest 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 and a Match badge, because case and colons are stripped before comparing

When to use it

• Verifying a Linux installer image against the SHA-256 listing on the distribution's download page.
• Checking that a build artifact copied between machines is unchanged before deploying it.
• Confirming a backup archive still matches the checksum recorded when it was created.
• Fingerprinting a document before sending it so the recipient can confirm what they received.

Questions about File hash checker

Why is there no MD5 option?

The browser's Web Crypto API does not implement MD5, and this checker uses it for every digest. The MD5 generator page has a File tab for checksums that only publish MD5.

What happens when I change the algorithm after choosing a file?

The file is rehashed automatically with the new algorithm, so you do not need to pick it again. The old result is cleared and a new progress bar runs.

What formats of the expected hash does it accept?

Uppercase or lowercase, with spaces, colons or hyphens between groups, and an optional 0x prefix. It then checks the length, which must be 40, 64, 96 or 128 hex characters for the chosen algorithm.

Can it handle very large files?

Web Crypto cannot hash as a stream, so the whole file must fit in your browser's memory once. Several gigabytes may fail on some devices, even though reading happens in 4 MiB pieces to keep the page responsive.

If the hashes match, is the file safe?

It means the file equals what the checksum describes. That only helps if you got the checksum from a trustworthy channel, ideally not the same page an attacker could have altered along with the download.

Related tools

• CRC32 checksum generatorCalculate the CRC32 checksum of text or a file in hexadecimal and decimal.
• HMAC generatorGenerate a keyed-hash message authentication code for any message and secret key using SHA-1, SHA-256, SHA-384 or SHA-512.
• JWT verifierVerify a JWT's HMAC signature against a secret and validate its time claims.
• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text