Check a file hash
Get the SHA-256, MD5 or SHA-1 of any file and compare it against the checksum a download page publishes.
Any file type. It is read on this device, so large files take a moment.
Your files are hashed on this device. Nothing is uploaded.
What a hash tells you
A hash is a fixed-length fingerprint computed from every byte of a file. Change one byte anywhere and the fingerprint changes completely. So if the value you compute matches the one the publisher printed, you have exactly the file they published, not a truncated download or a copy someone altered along the way.
Why paste the published value
Comparing two 64 character strings by eye is how people convince themselves a mismatch is a match. Paste the published value instead: the tool strips spaces and capitals, works out the algorithm from the length and gives a plain answer. A 32 character value is MD5, 40 is SHA-1, 64 is SHA-256.
MD5 and SHA-1 are for accidents, not attackers
Both are broken in the specific sense that it is feasible to make two different files that share a value. That doesn’t matter for spotting a download that went wrong, which is what most people are doing. It matters a great deal if you’re relying on the hash to prove nobody swapped the file and for that only SHA-256 or stronger will do.
Common questions
How do I check a download isn’t corrupted?
Copy the checksum the download page publishes, paste it into the comparison box and drop the file. The tool works out which algorithm the published value is from its length, computes the same one for your file and tells you in words whether they match.
Which algorithm should I use?
Whichever the publisher used, since the point is to compare against their value. If you get a choice, SHA-256 is the modern standard. MD5 and SHA-1 are fine for spotting a corrupted download but shouldn’t be trusted where someone might deliberately tamper with the file.
Is MD5 safe to use?
For catching accidental corruption, yes. For security, no: it is practical to construct two different files with the same MD5, so a matching MD5 doesn’t prove a file wasn’t swapped by an attacker. Use SHA-256 when that matters.
Is my file uploaded to be hashed?
No. The file is read and hashed inside this tab, which is the only sensible design for a tool whose whole purpose is checking a file hasn’t been interfered with. Sending it somewhere else first would defeat the exercise.
Why does the same file give a different hash after I edited it?
Because a hash changes completely if even one byte changes. That is the property that makes it useful: two files with the same SHA-256 are, for any practical purpose, identical and any difference at all shows up as a completely different value.
Guides
The other tools
All of them work the same way: the file is read in your browser and never uploaded.