Hash Compare
Paste a published checksum. Surrounding spaces, line breaks and a trailing filename are ignored.
The two hashes match
Identical, ignoring case and surrounding whitespace. If one came from a trusted source and the other from your own file, the file is intact.
- SHA-256
- Algorithm
- 64
- First length
- 64
- Second length
The comparison takes two hashes and tells you whether they match. Comparing sixty-four hex characters by eye is genuinely unreliable. The failure mode is that you check the first six and the last six and miss a change in the middle, so the comparison is done character by character, with the first difference reported.
How it works
- Both inputs are normalised before comparison: surrounding whitespace, line breaks and any trailing filename are stripped, since published checksums often arrive as "abc123... filename.iso".
- Comparison is case-insensitive, because hexadecimal case carries no meaning and different tools disagree about it.
- The algorithm is inferred from the digest length: 32 characters is MD5, 40 SHA-1, 56 SHA-224, 64 SHA-256, 96 SHA-384 and 128 SHA-512.
- Two digests of different lengths cannot be the same algorithm, which is reported as its own finding. It usually means one side hashed with something different rather than that the file changed.
Hash functions have the avalanche property: changing a single bit of the input changes about half the bits of the output. There is no such thing as two hashes being nearly the same, which is why any difference at all means the data differs.
Examples
The same digest in different cases
Hashes
One uppercase, one lowercase SHA-256
Result
Match: algorithm SHA-256
Hex case is presentation only. Tools disagree: sha256sum emits lowercase, several Windows utilities emit uppercase.
A digest with a filename appended
Hash
e3b0c442… ubuntu.iso
Result
The filename is ignored
This is the exact format of a .sha256 file, so pasting one directly works rather than needing to be trimmed first.
Different lengths
Hashes
40 characters against 64
Result
Flagged: SHA-1 against SHA-256
Not a corrupted file, the two sides used different algorithms. Rehash with the one the publisher used.
Frequently asked questions
Does the case of the letters matter?
No. Hexadecimal digits carry the same value in either case, and different tools emit different cases, sha256sum lowercase, several Windows utilities uppercase. They are compared case-insensitively, so the same digest in two cases correctly reports as a match.
The hashes are almost identical, is the file nearly right?
No. Hash functions avalanche: one changed bit in the input flips roughly half the output bits. Two digests differing in one character came from genuinely different data. There is no partial match, and no such thing as close.
What does it mean if the lengths differ?
The two sides used different algorithms, so the comparison is meaningless. A 40-character digest is SHA-1 and a 64-character one is SHA-256. Find out which the publisher used and hash your file again with that one.
Should I still trust an MD5 checksum?
For detecting accidental corruption, yes. A truncated download will not produce a matching MD5 by chance. For anything security-related, no: MD5 and SHA-1 are both broken against deliberate collisions, so an attacker can craft a file matching a published digest. Use SHA-256 for anything that matters.
How do I get the hash of my file in the first place?
The file checksum calculator hashes a local file with SHA-256 in your browser. On the command line, sha256sum on Linux, shasum -a 256 on macOS, or Get-FileHash in PowerShell all produce the same digest.