Checksum Verifier
Runs in your browser — your files are not uploaded to use this tool.
Save this tool
Keep Checksum Verifier handy
Use your browser's Share menu, then “Add to Home Screen”.
A checksum verifier: paste the published SHA-256 and check your download matches.
- Paste the checksum published alongside the download
- Drop in the file you downloaded
- Read the answer — match, or not
- Expected
- Actual
- Algorithm
About this tool
When a project publishes a checksum next to a download, it is telling you what the file should hash to. Verifying it catches a download that was truncated, corrupted in transit, or replaced with something else entirely — the last of which is the reason checksums exist at all. The usual way to check is to generate a hash and compare two 64-character strings by eye. People are bad at that. The eye checks the first few characters and the last few and calls it a match, which is precisely the part anyone tampering with a file would take care to preserve. This tool does the comparison for you and answers in a word. Paste the checksum in whatever shape you found it. A bare hex string works, so does a whole line copied out of a SHA256SUMS file with the filename still attached, so does an sha256: prefix from a container registry, and so does an integrity attribute from a web page. The algorithm is read from what you paste rather than being a setting to get wrong — SHA-1, SHA-256, SHA-384 and SHA-512 are all recognised by their length. The file never leaves your browser. That matters more here than usual: the point of a checksum is to remove the network from the question of whether your copy is intact, and uploading the file to find out would put it straight back in.
Frequently asked questions
How do I verify a SHA-256 checksum?
Paste the SHA-256 the publisher listed, then drop in the file you downloaded. The file is hashed in your browser and compared against what you pasted, and the answer is a plain match or no match rather than two long strings for you to compare yourself.
Which checksum formats can I paste?
A bare hex digest, a full line from a SHA256SUMS or CHECKSUMS file including the filename, a prefixed form like sha256:abc123, or a Subresource Integrity value like sha256-47DEQpj8… in base64. All four are recognised, and so are upper-case digests.
Do I need to choose the algorithm?
No, and that is deliberate. The algorithm is worked out from the checksum itself — 40 hex characters is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Choosing wrongly would report a confident mismatch on a perfectly good file, and anyone who knew which one they were holding would not need this page.
Why is MD5 not supported?
Two reasons. Web Crypto does not implement MD5, so supporting it would mean shipping a hand-written copy of it. And MD5 has been broken since 2004: it is possible to construct two different files with the same MD5, so a match does not prove what people think it proves. If a project only publishes MD5, ask them for a SHA-256.
What does it mean if the checksum does not match?
Most often the download was incomplete or corrupted, and downloading it again fixes it. Less often you have the checksum for a different version or a different file — check the filename, which this tool shows you if the checksum line included one. Rarely, the file is not the one the publisher released, in which case do not open it.
Is my file uploaded?
No. The hashing happens in your browser using the Web Crypto API built into it, and the file never leaves your device. This is the tool where that guarantee matters most: a checksum exists to take the network out of the question, so uploading the file to check it would defeat the purpose.
Help improve this tool
Found a bug, want a change, or need a tool we don't have?
You have an unsent draft.
Thanks — that's with us. You'll find the reply in your inbox.Go to my messages