File Checksum Verifier

Checksums answer one question well: did these bytes arrive exactly as they left? A truncated download, a flaky USB transfer or a corrupted archive all produce a different digest immediately, because a single altered bit cascades through the whole output. What a checksum cannot tell you is whether the file was legitimate in the first place. If someone compromises a download server, they can replace both the file and the checksum listed beside it, and the two will match perfectly. That is why serious projects publish a signature over the checksum file rather than the checksum alone — and why matching a hash from the same page you downloaded from is weaker evidence than it feels.

A hash function reduces any input to a fixed-length digest — 256 bits for SHA-256, written as 64 hexadecimal characters. Changing a single bit of the input changes roughly half the output bits, which is why comparison is all-or-nothing.

A checksum proves integrity, not authenticity: it confirms the bytes match what the publisher hashed, but if an attacker can alter both the file and the published checksum, the two will still agree. For genuine authenticity you need a cryptographic signature such as GPG. The whole file is read into memory, so extremely large files may exceed what the browser allows, and SHA-1 is offered only for checking older published values — it is no longer collision-resistant.

Hashing a file containing just “hello” with SHA-256 always gives 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824. Change one character and the digest is entirely different.

1. Choose the file you want to check.
2. Pick the algorithm the publisher used — usually SHA-256.
3. Paste the published checksum into the expected field.
4. Read the match verdict.

• Comparing against a checksum computed with a different algorithm.
• Trusting a checksum published on the same compromised page as the file.
• Assuming a matching hash proves the file is safe rather than unaltered.
• Still relying on SHA-1 for anything security-relevant.

This tool computes the SHA checksum of a file you select and compares it against a value you paste in, telling you plainly whether they match. The file is read directly by your browser using the Web Crypto API, so it is never uploaded anywhere.

Anyone verifying a download, checking that a transferred file arrived intact, or confirming two copies of a file are identical.

• The file never leaves your device, unlike upload-based checksum sites.
• Accepts a full “hash filename” line and extracts the hash for you.
• Case-insensitive comparison, so uppercase published values still match.
• Tells you when a length mismatch means you picked the wrong algorithm.

• Verifying an ISO or installer against the publisher’s checksum.
• Confirming a large file copied or downloaded without corruption.
• Checking that two copies of a document are byte-for-byte identical.
• Producing a checksum to publish alongside a file you distribute.