File Checksum Calculator
Hashed in your browser. The file is never uploaded.
:
Paste the expected value to verify a download.
The file checksum calculator hashes a file with SHA-256, SHA-1, SHA-384 or SHA-512 and compares the result against a checksum you paste in. The file is read by your browser and never uploaded, which matters, because verifying a download by sending it to a third party defeats the purpose.
How it works
- The file is read into memory as an array buffer.
- The Web Crypto API hashes those exact bytes with the algorithm you chose.
- The digest is rendered as lowercase hexadecimal, which is the convention every checksum publisher uses.
- If you paste an expected value, it is compared case-insensitively with whitespace removed.
A checksum verifies integrity, not authenticity. It proves the file matches what the publisher hashed, but only if you obtained the checksum from a source an attacker could not also have modified. A checksum published on the same page as a compromised download proves nothing.
SHA-256 is the default because it is what nearly every project publishes. SHA-1 is included for older releases and should not be trusted for security, having been broken for collision resistance since 2017.
Examples
Verifying a download
File
installer.dmg
Expected
the SHA-256 from the project site
Result
Checksums match: the file is byte-for-byte what the publisher hashed
Comparison ignores case and whitespace, so a checksum copied with a trailing space or in uppercase still matches.
A mismatch
File
a partially downloaded archive
Result
Checksums do not match
Most often an incomplete or corrupted download, or a different version than the checksum refers to. Occasionally something worse. Do not run the file.
Frequently asked questions
How is this different from the hash generator?
The hash generator hashes text you type, so it hashes the characters. This hashes the bytes of a file, which is what a published checksum refers to. Pasting a file’s contents into a text hasher gives a different digest, because encoding and line endings change the bytes.
Does a matching checksum mean the file is safe?
It means the file matches what the publisher hashed. Whether that is safe depends on trusting the publisher and on where you got the checksum, if both came from the same compromised page, they will agree with each other and prove nothing. Get the checksum from a separate, trusted source where you can.
Is there a file size limit?
The file is read entirely into memory, so very large files depend on available RAM. Several hundred megabytes is comfortable on a desktop; multi-gigabyte ISOs are better hashed with a command-line tool, which streams rather than loading everything at once.
Should I still use SHA-1?
Only for checking against older published checksums. SHA-1 collisions have been practical since the 2017 SHAttered attack, so it can no longer prove a file has not been deliberately altered. It remains adequate for catching accidental corruption.