File checksum
Drop a file and get MD5, SHA-1, SHA-256 and SHA-512. Paste the value published by the site and I tell you at once whether it matches, or add a second file and find out whether the two are really identical. All in your browser, the file is never uploaded.
or click to pick it, it stays on your device
no file chosen
only needed to tell whether two files are identical
no file chosen
🔒 The file is read inside the browser, block by block, and never uploaded to any server.
How to use it
Drop the file into the first box (or click to pick it) and the fingerprints appear on their own, with the bar moving while the file is read. If the site you downloaded from publishes a checksum, paste it into the field and nothing else is needed: from its length the tool works out whether it is an MD5, a SHA-1, a SHA-256 or a SHA-512, ticks the right algorithm by itself and answers yes or no, so you never have to compare 64 digits by eye. You can also paste the whole line produced by sha256sum or certutil -hashfile, filename included, and upper or lower case makes no difference. The second box answers a different question, namely whether two files you already have on disk are really the same file.
What a checksum is, and what it actually protects you from
A hash function grinds through every byte of the file and always returns the same number of digits, 32 for MD5 and 64 for SHA-256, whether the file weighs 3 KB or 8 GB. Change a single bit and the fingerprint changes completely, because roughly half the digits flip (the avalanche effect). That is why comparing checksums catches a download cut short, a bad byte on a tired USB stick or a backup copied badly, damage you cannot see and that you pay for later with a baffling error halfway through an install. There is a limit worth remembering, though, because a checksum protects you from accidents and not from an attacker: if somebody can replace the file on a mirror, they can almost always change the page that publishes its value too. For authenticity you need a digital signature (GPG, for instance) or a value taken from a different, trustworthy source.
MD5 and SHA-1 are broken, and there is still a reason to keep them
Collisions for MD5 have been public since 2004, found by Wang Xiaoyun and colleagues, and for SHA-1 since 2017, when Google and CWI Amsterdam published SHAttered, two different PDFs with the same SHA-1. A collision means two different files can be built on purpose with the same fingerprint, so neither algorithm proves any more that a file is the original one. They remain perfectly fine for the practical question a downloader has, which is whether the file arrived whole and undamaged, and they are still needed because that is the value many projects publish next to their files. If a SHA-256 sits next to it, use that one.
How they are computed here, and what it cannot do
MD5, SHA-1 and SHA-256 are written by hand in JavaScript inside this page, in incremental form: the file is read in 4 MiB blocks and each block feeds the internal state of the algorithm, so no full copy of the file ever sits in memory and size is not a problem. MD5 has to be done by hand because WebCrypto, the browser crypto engine, does not offer it. SHA-512 is the exception: it works on 64 bit words, which JavaScript does not have, so it is handed to WebCrypto, which in turn demands the whole file in memory at once. On files of several gigabytes that request can fail, and when it does the tool says so and suggests unticking SHA-512. The time depends only on your processor and grows in proportion to the bytes, which is why the result tells you how many MiB per second were ground through, and the Stop button cuts a long calculation short straight away.
Common mistakes, and what to do when it does not match
The first mistake is comparing fingerprints by eye, because the eye checks the beginning and the end and skips the middle, which is exactly where the difference hides. The second is believing that upper and lower case matter, while A and a are the same hex digit. The third is about format, because some projects publish the value in base64 rather than hex (44 characters for a SHA-256, often ending in an equals sign) and here it is recognised and converted. Remember as well that the checksum of a zip archive is not the checksum of the files inside it, and that two files of different size are already different without computing anything. If the value does not match, the download was almost certainly interrupted, so fetch it again and retry. If it fails a second time with the same fingerprint, the file on the server may really differ from the one announced: do not install it and look for an official mirror.