Verify a download with a file hash checker
A file hash checker calculates a checksum — a short fingerprint such as an MD5 or SHA-256 value — for any file and lets you compare it with the one published by the software’s author. If the two match, the file you downloaded is byte-for-byte identical to the original: not corrupted by a flaky connection, not truncated, and not swapped for a tampered copy by a mirror or a compromised network.
This tool computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 directly in your browser. Files are read in 4 MB chunks and hashed incrementally, so a multi-gigabyte ISO image works without being loaded into memory or uploaded anywhere. Paste the expected hash and you get an immediate match or mismatch badge.
How to use the File Hash Checker
- Drop one or more files onto the drop area, or click it to choose them. Each file starts hashing straight away with a progress bar.
- Tick the algorithms you need. MD5, SHA-1 and SHA-256 are selected by default; add SHA-384 or SHA-512 if the download page lists those.
- Paste the published checksum into “Expected checksum”. The algorithm is detected from its length and the matching row turns green (Match) or red (Mismatch).
- Copy a single hash with its button, or use “Copy all” and “Download checksums.txt” for a sha256sum-style list.
File Hash Checker features
Streams files of any size
MD5, SHA-1 and SHA-256 are implemented incrementally in the page, so a 20 GB disk image is hashed chunk by chunk with constant memory.
Automatic algorithm detection
A 32-character hash is treated as MD5, 40 as SHA-1, 64 as SHA-256, 96 as SHA-384 and 128 as SHA-512 — upper or lower case, with or without spaces.
Clear match verdict
A green Match or red Mismatch badge sits next to the relevant hash, and the tool warns if you have not ticked the algorithm the expected value needs.
Batch and export
Hash several files at once and export every result in the familiar “hash filename” format used by sha256sum and md5sum.
Nothing is uploaded
Files are read with the File API on your device. The page never sends their contents anywhere.
Why checksums matter for downloads
Linux distributions, virtualisation tools, firmware, developer SDKs and many installers publish a SHA-256 (sometimes MD5 or SHA-512) value next to each download. A hash is deterministic — the same bytes always give the same value — and even a single flipped bit changes it completely. Comparing the hash therefore proves that your copy is intact and identical to what the publisher released.
A matching hash does not prove the file is safe or that the publisher is who they claim; it only proves the file matches the hash you were given. For that reason, read the expected value from the vendor’s HTTPS site, not from the same mirror that served the file, and prefer downloads that are also signed (GPG or code-signing certificates).
Which algorithm should you use?
MD5 and SHA-1 still detect accidental damage reliably — the chance of a random error producing the same hash is negligible — but an attacker who can modify the file could, with effort, craft a malicious version with the same MD5 or SHA-1. When a site offers a choice, verify the SHA-256 or SHA-512.
| Algorithm | Hash length | Status | Typical use |
|---|---|---|---|
| MD5 | 128 bits · 32 hex | Broken for security (collisions since 2004) | Legacy checksums, detecting accidental corruption |
| SHA-1 | 160 bits · 40 hex | Collisions demonstrated (SHAttered, 2017) | Git object IDs, older download pages |
| SHA-256 | 256 bits · 64 hex | Secure, recommended | Most download verification, package managers |
| SHA-384 | 384 bits · 96 hex | Secure | Some government and TLS profiles |
| SHA-512 | 512 bits · 128 hex | Secure, fast on 64-bit CPUs | Debian/Ubuntu ISOs, large archives |
Checking hashes on the command line
The same verification is built into every operating system. The values will be identical to what this tool shows.
- Windows (PowerShell):
Get-FileHash .\ubuntu.iso -Algorithm SHA256, orcertutil -hashfile file.exe MD5. - macOS:
shasum -a 256 file.dmgormd5 file.dmg. - Linux:
sha256sum file.iso; with aSHA256SUMSfile:sha256sum -c SHA256SUMS --ignore-missing. - For text rather than files, including HMACs and SHA-3, see the Hash Generator. To protect a file so that nobody can read it, use Text Encryption.
File Hash Checker FAQ
Is my file uploaded to check its hash?
No. The file is read by JavaScript on your own device, piece by piece, and only the resulting hash is shown. Nothing is transmitted, which also makes it fast for large files.
How big a file can the file hash checker handle?
MD5, SHA-1 and SHA-256 stream the file in 4 MB chunks, so size is limited only by your patience — a 4 GB image takes a minute or two. SHA-384 and SHA-512 use the browser’s Web Crypto API, which needs the whole file in memory, so they are limited to 512 MB.
What does a mismatch mean?
The file is not identical to the one the hash was made from. Most often the download was interrupted or you have a different version. Download it again from the official source and re-check; if it still differs, do not install it.
Do upper-case and lower-case hashes differ?
No. Hexadecimal is case-insensitive, and the tool ignores case, spaces and dashes when comparing.
Why is MD5 still used if it is broken?
MD5 is fast and perfectly good at detecting accidental corruption, so many sites still publish it. It is only unsafe against a deliberate attacker who can craft a colliding file; prefer SHA-256 when both are offered.
Can I verify the SHA256SUMS file from a Linux distribution?
Yes. Open the SHA256SUMS text file, copy the 64-character hash listed next to your ISO’s filename, paste it into “Expected checksum” and drop the ISO. The SHA-256 row shows Match or Mismatch.