File Hash & Checksum

How to use the file hash & checksum

1. Choose any file.
2. Wait for the four digests.
3. Paste the publisher's checksum to compare automatically.

About this tool

Hashing a download and comparing it against the checksum on the project's page confirms the file arrived intact and unmodified. All four digests are produced at once, so whichever the publisher used is there.

Particularly worth doing here rather than with an online service: the file is read on your device and never uploaded, so you can verify a private archive or an installer without handing it to anyone.

What a match proves is narrow but real: the bytes are identical to the ones the checksum was taken from. It does not prove the file is safe, and it proves nothing at all if the attacker who replaced the file also controls the page showing the checksum. Compare against a checksum published somewhere separate where you can.

Common uses

• Verifying an installer or ISO after downloading it.
• Checking that a transferred file is intact.
• Confirming two files are identical.

Frequently asked questions

Which hash should I use?

SHA-256 for anything current. SHA-1 is included because older projects still publish it, but it is no longer collision resistant.

Is there a file size limit?

The whole file is read into memory, since Web Crypto has no streaming digest. Multi-gigabyte files may exceed what the browser can hold.

Does a matching hash mean the file is safe?

No. It means the file matches the checksum. If the same attacker controls both the file and the checksum, both will agree.