File Checksum Verifier
All five checksums at once, then paste the expected hash — it works out which algorithm matched.
How to Use
- 1. Drop the file in, or click to choose it.
- 2. Wait for all five checksums to be calculated.
- 3. Paste the expected hash from the download page.
- 4. Check the verdict — it tells you which algorithm matched.
Why Verify a Download
A hash is a fingerprint of a file's exact contents. Change one byte — a transfer that silently truncated, a failing disk, a mirror somebody tampered with — and the hash comes out completely different, not slightly different. That all-or-nothing property is what makes it useful: matching hashes means the bytes you have are the bytes the publisher released.
This is why installers, disk images and release archives publish checksums alongside the download. It is also why the check is only meaningful if you get the expected hash from a trustworthy place. A hash published on the same compromised page as the file proves nothing, which is why projects sign their checksum files or publish them on a separate domain.
On algorithm choice: MD5 and SHA-1 are perfectly adequate for catching accidental corruption and plenty of projects still publish them. Neither should be trusted against a deliberate attacker, because collisions can now be manufactured — for that, use SHA-256, which is the modern default for release verification.
All five run locally through the browser's built-in WebCrypto, except MD5, which WebCrypto deliberately omits and which is implemented here over raw bytes. Nothing is uploaded, so verifying a private file is safe.
Related: Text Hash Generator, HMAC Generator, and Base64 File Converter.
Frequently Asked Questions
What is a checksum for?
It proves a file arrived intact and unaltered. A download page publishes the hash of the original; you hash your copy and compare. If a single byte changed — a truncated transfer, a corrupted disk, a tampered mirror — the hash comes out completely different.
Is my file uploaded to check it?
No. The file is read and hashed inside your browser using the built-in WebCrypto API, and nothing is transmitted. That is what makes it safe to verify a private or sensitive file here.
Which algorithm should I compare against?
Whichever the publisher used — you do not have to know. Paste the expected hash and this tool checks it against all five results and tells you which one matched. SHA-256 is the modern standard for release verification.
Is MD5 still useful?
For catching accidental corruption, yes, and plenty of projects still publish it. For proving a file was not deliberately tampered with, no — MD5 collisions can be manufactured cheaply, so prefer SHA-256 when the threat is an attacker rather than a bad download.
Why does a large file take a while?
Every byte has to pass through the hash function. The file is read in chunks so memory stays flat and progress is shown, but a multi-gigabyte file is genuinely a lot of arithmetic. MD5 and SHA-1 are faster than SHA-512 if you only need a quick integrity check.