Check that a download isn't corrupted or altered. Compare two files, match a file to a published hash, or verify a full checksum list.
This tool runs entirely in your browser. What you enter is never sent anywhere.Your input is never sent anywhere.
DetailsCompare two files
Drop file A here
or click to choose a file
Drop file B here
or click to choose a file
Check Whether a File Was Corrupted or Changed
A file's hash is a short fingerprint calculated from its contents. If a download is damaged or altered, its hash changes. To verify a file, you calculate the hash of your copy and compare it with the value the publisher lists. This page does both steps for you.
Pick a mode: compare two files, check one file against a published hash, or verify several files against a checksum list such as a SHA256SUMS file. Paste a hash and the tool picks the algorithm from its length: MD5, SHA-1, SHA-256, SHA-384, or SHA-512.
Your files are read and hashed in your browser. Nothing is uploaded.
Common Uses: ISOs, Installers, Backups, Shared Files
Check an ISO or installer you just downloaded
Paste the SHA-256 value from the download page, add the file, and see right away whether your copy matches. A mismatch often means the download was interrupted.
Confirm a backup copy is identical
Drop the original and the copy into "Compare two files." If the hashes match, the contents are the same, even if the file dates or names differ.
Verify a release with a SHA256SUMS file
Paste the contents of the checksum file, add every file you downloaded, and get a match or mismatch for each one in a single list.
Check a file someone sent you
If the sender gives you the hash through a different channel, such as a phone call or a separate message, you can confirm the file wasn't changed in transit.
How to Check a Download Against Its SHA-256 Checksum
- Choose a mode: "Compare two files," "Check against a hash," or "Verify a checksum list."
- Drop your file or files into the box, then paste the published hash or checksum list. Comparing two files needs no hash.
- Read the result. The tool hashes the files and shows a match or mismatch as soon as the hashing finishes.
Note: Results update by themselves when you change a file, a hash, or the algorithm. There's no calculate button.
Limits to Know Before You Rely on a Match
- A mismatch tells you the files differ, not why. It could be a broken download, a different version, or a modified file.
- MD5 and SHA-1 are fine for catching accidental corruption, but collision attacks exist for both. Use SHA-256 or stronger when security matters.
- A hash is only as trustworthy as the place you got it from. See the section below on what a match does and doesn't prove.
- Uppercase or lowercase, extra spaces, and colons between bytes are ignored when you paste a hash.
- The whole file is loaded into your browser's memory, so very large files may fail on some devices.
- Files and hashes are processed in your browser and are not sent to any server.
Checksum List Formats You Can Paste
In "Verify a checksum list" mode, each line is read on its own, so you can paste a list as it appears on the download page.
| Format | Example line | Where you see it |
|---|---|---|
| GNU style | 3a7bd3e2… filename.zip | Output of sha256sum, md5sum, and similar Linux commands |
| GNU binary mode | 3a7bd3e2… *filename.zip | sha256sum run in binary mode |
| BSD style | SHA256 (filename.zip) = 3a7bd3e2… | macOS md5, FreeBSD sha256, openssl dgst |
| Labeled hash | sha256:3a7bd3e2… | Some download pages and container image digests |
| Hash only | 3a7bd3e2… | A single value with no filename |
The algorithm is chosen from the hash length: 32 characters for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384, and 128 for SHA-512. Lines with any other length are skipped.
What a Hash Match Does and Doesn't Prove
How to read the result, and when you need more than a match.
A match means your copy is identical to the original
A good hash function gives a completely different result when even one byte of the input changes. So if your file's SHA-256 equals the published value, your copy is the same as the file that was hashed, for all practical purposes. That rules out a cut-off download and random corruption.
A match doesn't prove the hash itself is genuine
If an attacker can change the file on a server, they may be able to change the hash on the same page. For software you must trust, get the hash from a second, independent source or verify the publisher's digital signature, such as a GPG signature, in addition to checking the hash.
Which algorithm to check against
Use whatever the publisher lists, and prefer SHA-256 or stronger when there is a choice. MD5 and SHA-1 still catch accidental damage, but researchers have shown collision attacks against both, so they are a weak defense against someone who creates files on purpose.
What to check if the hashes don't match
First, confirm both hashes use the same algorithm. Second, confirm you have the same version and the same file the hash was published for, such as the .iso itself and not the files inside it. Third, check that the download finished and the file size matches the size listed. If all three look right, download the file again and check it again.
Why Your Hashes Don't Match
Comparing hashes from two different algorithms
The publisher lists a SHA-256 value, but you compared it with an MD5 value you calculated elsewhere. The file is fine, yet the two strings never match.
💡 See the solution▼
Copying extra text along with the hash
A trailing space, a line break, or a label such as "SHA256:" ends up in the copied text, so a plain string comparison fails even though the hash is correct.
💡 See the solution▼
Using the hash of a different file in the list
A checksum list names many files. Copying the line above or below the one you need gives a mismatch for a perfectly good download.
💡 See the solution▼
Running or installing a file that didn't match
You see a mismatch but open the installer anyway because you're in a hurry.
💡 See the solution▼
FAQ: Checksums, Algorithms, and Privacy
Q.What's the difference between generating a hash and verifying one?
A. A hash generator calculates a file's hash and stops there. This tool also compares the result: with a second file, with a hash the publisher lists, or with a checksum list, and tells you whether they match. If you only need the hash, open "Check against a hash," leave the hash box empty, and pick an algorithm.
Q.Do I need to know whether my hash is MD5 or SHA-256?
A. No. The tool removes every character that isn't 0-9 or a-f, then reads the length: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384, and 128 is SHA-512. Uppercase or lowercase and extra spaces don't matter.
Q.Which checksum list formats can I paste?
A. The tool reads the output of sha256sum and md5sum (hash, then filename, with or without a * before the name), BSD-style lines such as SHA256 (file.zip) = hash, labeled values such as sha256:hash, and bare hashes. Each line is read on its own. If a filename includes a folder path, only the final filename is used to match your files.
Q.Can I check several files at once?
A. Yes. Use "Verify a checksum list," paste the list from the download page, and add all the files you downloaded. Each file is matched to the list by filename and marked as a match, a mismatch, or not in the list. Files named in the list that you haven't added yet are shown separately.
Q.Are my files uploaded anywhere?
A. No. Your files are read into your browser's memory and hashed on your device. Nothing is sent to our servers. The data is released when you close or reload the page, or press "Clear everything."
Q.Why don't my hashes match?
A. The usual causes are an incomplete or corrupted download, a different version of the file than the one the hash was published for, a hash made with a different algorithm, or a file that was modified. Also check that you hashed the file the publisher listed: a hash for a .zip or .iso doesn't apply to the files extracted from it. Re-download the file and check again.
Q.How large a file can I check?
A. The tool loads the whole file into your browser's memory, so very large files (several GB) may fail or slow your browser down. The limit depends on your browser and device. MD5 is calculated by code on this page rather than a built-in browser function, so it can take longer on large files. For multi-GB files, a command line tool is more reliable: shasum -a 256 file on macOS, sha256sum file on Linux, or Get-FileHash file in PowerShell.
Q.Does it support SHA-3, BLAKE2, SHA-224, or CRC32?
A. No. Only MD5, SHA-1, SHA-256, SHA-384, and SHA-512 are supported. Be careful with algorithms that produce the same length: a 64-character SHA3-256 or BLAKE2s hash would be read as SHA-256 and show a mismatch even for a good file.
Q.Is a matching hash enough to trust a file?
A. A match shows that your copy is identical to the file the hash was calculated from. It doesn't prove the hash itself is genuine. If the file and the hash come from the same compromised page, both can be replaced. For software you must trust, get the hash from a second, independent place or verify the publisher's digital signature.
Your feedback
makes this tool better.
Tell us which features you'd like, what should be fixed, or which new tool you'd like to see. An engineer reads every submission and uses it to guide development.