A checksum is a short fingerprint of a file; if even one byte changes, the SHA-256 value changes completely. Paste the value a publisher lists and this page tells you whether your download matches, picking the algorithm from the length (64 hex characters for SHA-256, 40 for SHA-1, 32 for MD5). SHA-1 and MD5 are fine for spotting damaged downloads but not for proving a file was not tampered with.
What a file hash tells you
A cryptographic hash function reads every byte of a file and produces a fixed-length string, written in hexadecimal. The same file always gives the same value. A different file, even one that differs by a single bit, gives a value that looks completely unrelated.
That makes a hash useful for one specific question: is the file I have exactly the file someone else has? Typical cases:
- Checking a download. Operating system images, firmware updates, password manager installers and many open-source releases list a SHA-256 next to the download link. If your file's hash matches, the download is complete and unchanged.
- Comparing copies. Two backups, a file before and after a transfer, an attachment someone says they sent: matching hashes mean identical contents.
- Recording evidence of a file's state. Noting a file's hash lets you show later that it has not changed since.
A hash does not tell you whether a file is safe or what is inside it. A malicious file has a perfectly ordinary hash. The check only means something when the expected value comes from a source you trust, ideally a different channel from the download itself, such as the publisher's site over HTTPS or a signed release note.
Check a file in four steps
- Choose one or more files with the file button, or drop them on the page. Any file type works, from a small text file to a multi-gigabyte disk image.
- Leave the algorithms you need ticked. All five are ticked by default; unticking the ones you do not need makes very large files finish sooner.
- Press Start. A progress line shows how much of each file has been read. Each finished file gets one line per algorithm, with a button to copy the value.
- Paste the published checksum into Expected hash. The page works out which algorithm it is from its length and shows Match or No match for each file.
The Expected hash box ignores uppercase and lowercase and any spaces. You can also paste a whole line from a checksum list, such as <hash> ubuntu.iso or SHA256 (file.zip) = <hash>, and the page picks out the hash.
Which algorithm to use
| Algorithm | Length in hex | Use it for | Notes |
|---|---|---|---|
| SHA-256 | 64 | Checking downloads and comparing files | The common choice for published checksums; part of the SHA-2 family defined in NIST's FIPS 180-4 |
| SHA-384 | 96 | Same | Less common; some security software and certificates use it |
| SHA-512 | 128 | Same | Often used by Linux distributions and package systems |
| SHA-1 | 40 | Comparing files only | Not safe against deliberate tampering. A practical collision (two different files, same SHA-1) was published in 2017, and NIST plans to retire SHA-1 by the end of 2030 |
| MD5 | 32 | Comparing files only | Collisions have been known since 2004; in 2012 the Flame malware used one to forge a code-signing certificate |
SHA-1 and MD5 are labeled on the page as suitable for checking whether files are the same, not for security. They are still useful for spotting a corrupted or truncated download, and some older sites list nothing else. When a publisher offers SHA-256 or SHA-512, use that.
Reading the result
- Match: the file you have is byte-for-byte the file whose checksum was published (for SHA-2, there is no known way to fake that).
- No match: something differs. Most often the download was interrupted, a proxy or antivirus changed the file, or you are comparing with the checksum of a different version or a different file in the list. Download again from the official source and recheck. If it still fails, do not run the file.
- "Not the length of a known hash": the pasted value has the wrong number of characters. Check that you copied the whole value and nothing else.
Large files and how fast it goes
Files are read in slices of 8 MiB and fed to all the ticked algorithms at once, in a background worker. The whole file is never loaded into memory, so multi-gigabyte images work on ordinary computers and on most phones. Speed depends on your device and storage; computing five algorithms takes longer than one, so untick the ones you do not need for very large files.
You can hash several files in one go. Each gets its own result block, and a pasted checksum is compared against all of them, which helps when you have a folder of downloads and one published list.
Your files are not uploaded
The file is opened through your browser's file picker and read slice by slice inside the tab. The hashing code runs in a background worker on your device. No part of the file and none of the results are sent anywhere. Leaving the page discards everything it read and computed.
Cross-checking with built-in tools
You can confirm any result here with the tools already on your computer:
- Windows (PowerShell):
Get-FileHash .\file.isogives SHA-256 by default; add-Algorithm SHA512,SHA1orMD5for others. - macOS:
shasum -a 256 file.isoin Terminal (-a 512or-a 1for others), ormd5 file.iso. - Linux:
sha256sum file.iso,sha512sum,sha1sumormd5sum.
All of them should print the same value as this page for the same file.
Technical note
Hashing uses the hash-wasm library, which compiles well-known C implementations of SHA-2, SHA-1 and MD5 to WebAssembly and supports feeding data in pieces. The browser's built-in Web Crypto API can compute SHA-2 too, but only on a whole file at once, which is not practical for large files. Want proof that the file stays put while it is hashed? The methodology page shows what to look for in your browser's request list.
FAQ
Is MD5 or SHA-1 good enough to verify a download?
Good enough to catch an accidental error such as a broken download. Not good enough to rule out deliberate tampering, because collisions can be manufactured for both. Prefer SHA-256 or SHA-512 when the publisher lists them.
Why does my hash not match?
Usually an incomplete or altered download, or a checksum for a different version or file. Download again from the official source and compare once more. A mismatch is a reason not to open the file.
Can I check a file larger than 4 GB?
Yes. The file is read in 8 MiB slices and never held in memory whole, so size is limited mainly by your patience.
Do I need to choose the algorithm before pasting the checksum?
No. The page recognizes the algorithm from the length of the pasted value: 64 hex characters for SHA-256, 96 for SHA-384, 128 for SHA-512, 40 for SHA-1, 32 for MD5.
Does this upload my file to compute the hash?
No. The computation runs in your browser, on your device. Keep your browser's developer tools open on the Network tab while it runs and you will see no request carrying the file.
Does a matching hash mean the file is safe?
It means the file is identical to the one the checksum came from. Whether that file is safe depends on the publisher, so get the checksum from a source you trust.
Sources
Checked 2026-10-11.
- NIST FIPS 180-4, Secure Hash Standard: definitions of SHA-1 and the SHA-2 family.
- NIST, "NIST Retires SHA-1 Cryptographic Algorithm" (December 15, 2022): phase-out by December 31, 2030.
- SHAttered: the first practical SHA-1 collision, Google and CWI Amsterdam, 2017.
- Microsoft Security Response Center on Flame (2012): the MD5 collision used to forge a certificate.
- Microsoft Learn: Get-FileHash: PowerShell's built-in file hashing, SHA-256 by default.
Last updated: