File Hash Checker

1. 01Choose the fileDrop it in or browse for it. Any file type works, because the tool reads raw bytes rather than trying to understand the format.
2. 02Pick the algorithmMatch whatever the publisher used. SHA-256 is by far the most common; the checksum length tells you which one you are looking at.
3. 03Paste the expected checksumOptional. With it, you get a clear match or mismatch instead of having to compare 64 characters by eye.
4. 04Read the answerMatch means your copy is byte for byte the one the checksum describes. Mismatch means it is not, and you should download it again.

• Verifying a downloaded ISO or installerProjects publish a checksum precisely so you can confirm the file you received is the file they released.
• Checking a large transfer arrived intactHash the file at both ends. Identical checksums mean nothing was lost or altered on the way.
• Confirming two files are truly identicalSame checksum means same bytes. It is a far stronger check than matching names and sizes.
• Recording a file’s fingerprintNote the checksum now, and you can prove later whether a file has changed since.

• A published SHA-256 that matchesThe 64-character value from the download page lines up exactly with your copy. Nothing went wrong in transit.
• A mismatchOne character differs, so the file differs. Download it again before you open or run it.
• The wrong algorithm pastedA 64-character SHA-256 pasted while SHA-512 is selected is reported as an invalid checksum for that algorithm, not as a mismatch.

• Get the checksum from the right placeA checksum published on the same compromised page it is meant to protect proves nothing. Where the publisher offers a signed or separately hosted list, prefer it.
• Case and stray spaces do not matterChecksums are compared case-insensitively and surrounding whitespace is ignored, so pasting from a terminal or a web page both work.
• A mismatch is not always an attackAn interrupted download is far more common than a tampered file. Re-download first; if it still does not match, stop and investigate.
• Match the algorithm to the published valueSHA-256 is 64 hex characters, SHA-384 is 96, SHA-512 is 128 and SHA-1 is 40. Count the characters if the page does not say.

A cryptographic hash turns any file into a fixed-length fingerprint. Change one byte anywhere and the fingerprint changes completely, so an identical checksum is strong evidence that two files are byte for byte the same. What it does not prove is that the file is safe or that it came from who you think: it only ties your copy to the value someone published. If an attacker controls both the file and the checksum, matching them means nothing, which is why where the checksum came from matters as much as the checksum itself.

The browser’s Web Crypto API does not implement MD5, and bundling a hand-rolled implementation to offer it would mean shipping cryptographic code of our own for an algorithm that is comprehensively broken. Plenty of sites still publish MD5 checksums, and for catching a corrupted download it is not useless, but it is not something this tool will add a dependency for. SHA-1 is included because Web Crypto already supports it and older downloads still list it; it is labelled legacy for the same reason.

Web Crypto’s digest function takes the whole input at once — there is no incremental or streaming mode — so the entire file has to fit in the browser’s memory while it is hashed. That is why there is a size limit of 128 MB rather than an unlimited box. The limit is set deliberately low: the same page has to work on a phone, where the memory headroom is a fraction of a desktop’s, and the failure mode of aiming high is a crashed tab rather than a slow one. It is also why there is no progress bar: the browser reports no progress during the digest, and an animated bar that is not measuring anything would be a lie about what is happening. Larger files hash in a noticeable pause and then finish. None of this changes where the work happens — the file is still read and hashed on your own device, and is not uploaded.

This is not a claim about policy, it is a description of the implementation: the file is read with the browser’s own file API and passed straight to Web Crypto in the page. There is no request carrying the bytes, no server-side processing, and no copy anywhere. The file name and the resulting checksum are not sent either — only the fact that the tool was used at all reaches analytics.

How do I check a file’s SHA-256 checksum?

Choose the file, leave the algorithm on SHA-256, and the checksum appears. To verify a download, paste the value the publisher listed into the expected checksum box and the tool will tell you whether they match.

Is my file uploaded anywhere?

No. It is read and hashed entirely inside your browser using the built-in Web Crypto API. No request carries the file, and neither the file name nor the checksum is sent anywhere.

What does it mean if the checksum does not match?

Your file is not the same as the one the checksum was generated from. Usually that means the download was interrupted or corrupted, so try again. If a fresh download still does not match, do not run the file.

Why is MD5 not offered?

The browser’s crypto API does not provide it, and adding a hand-written implementation of a broken algorithm is not a trade worth making. SHA-256 is what most publishers list; SHA-1 is available for older downloads and labelled legacy.

Which algorithm should I use?

Whichever the publisher used, since you are comparing against their value. If you are generating a fingerprint for your own records, use SHA-256.

How large a file can it handle?

Up to 128 MB. The browser’s digest function has no streaming mode, so the whole file has to fit in memory at once. The cap is set conservatively so the tool behaves the same on a phone as on a desktop, and beyond it the tool refuses up front rather than risking a crashed tab. The file is still processed on your own device either way.

Does this tell me whether a file is safe?

No. It tells you whether your copy matches a specific published checksum. A matching file can still be malicious if the publisher’s file was; the checksum only proves the two are identical.