File Checksum
Get the SHA-256, MD5, SHA-1 and SHA-512 of any file and check it against the published hash.
MD5, SHA-1, SHA-256 or SHA-512 — detected from the length. Case and spaces are ignored.
How It Works
Your browser reads the file from disk in 4 MB pieces. Each piece is fed to four hash functions at once (MD5, SHA-1, SHA-256 and SHA-512), compiled to WebAssembly by the open-source hash-wasm library. Because only one piece is in memory at a time, a 4 GB ISO works the same as a 4 KB text file. It just takes longer.
Paste the checksum from the download page and the tool works out which algorithm it is from its length, then compares. Capitals, spaces and a trailing file name (as in sha256sum output) are ignored.
To hash a piece of text rather than a file, use the text hash generator. For a step-by-step walkthrough, read how to verify a SHA-256 checksum without the command line.
What a Checksum Proves
A hash is a fingerprint of the file's exact bytes. Change a single byte and the SHA-256 changes completely. So if your result matches the value the publisher lists, you have exactly the file they hashed: the download was not cut short or corrupted.
It proves less about who made the file. If an attacker could change the download, they may also have changed the checksum on the same page. Checksums are most useful when the value comes from a separate, trusted place, such as the publisher's main HTTPS site, or when it is backed by a signature.
Hash Lengths at a Glance
| Algorithm | Hex characters | Use today |
|---|---|---|
| MD5 | 32 | Corruption checks only |
| SHA-1 | 40 | Corruption checks only |
| SHA-256 | 64 | The usual choice |
| SHA-512 | 128 | Also secure |
Speed depends on your device and disk. In our tests in Chrome, computing all four hashes at once ran at about 60 MB per second, so a 4 GB ISO takes a little over a minute. Phones and older computers are slower. Keep the tab open until it finishes.
Frequently Asked Questions
How do I verify a SHA-256 checksum?
Choose the downloaded file, then paste the SHA-256 value published on the download page into the expected hash box. The tool hashes the file and shows a clear match or mismatch. Capital letters and spaces in the pasted value do not matter.
Can it handle large files like ISO images?
Yes. The file is read in 4 MB pieces and fed to the hash functions as it goes, so it never has to fit in memory. A multi-gigabyte ISO takes longer, with a progress bar, but works the same way.
Which algorithm should I use?
Use whichever one the publisher lists, usually SHA-256. The tool computes MD5, SHA-1, SHA-256 and SHA-512 at once and works out which one you pasted from its length: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256 and 128 is SHA-512.
What does a mismatch mean?
The file you have is not byte-for-byte the file the publisher hashed. Most often the download was incomplete or you picked a different file or version. Download it again from the official site and re-check. Do not open or install a file that fails the check.
Is my file uploaded?
No. The file is read from your disk by your browser and hashed on your device with hash-wasm, an open-source WebAssembly library. Nothing is sent to a server.
Are MD5 and SHA-1 still safe to use?
For spotting a broken or incomplete download they work fine. They are not safe against deliberate tampering, because researchers have produced different files with the same MD5 or SHA-1. Prefer SHA-256 or SHA-512 when the publisher offers them.