Free File Hash & Checksum Verifier
Calculate SHA-256, SHA-384, SHA-512, SHA-1 or MD5 file checksums locally and compare a publisher’s expected hash. Chunked hashing and a worker keep file processing off the page.
Calculate and compare a file checksum
Verify bytes against a trusted checksum
A checksum is calculated from the file bytes, including whitespace and line endings in text files. Renaming a file does not change its digest. Compare the algorithm and expected value published over a trusted channel; a checksum alone is not a malware scan or digital signature.
SHA-256 follows NIST’s Secure Hash Standard. MD5 is included only for legacy checksums. The browser’s Web Crypto digest API processes the other supported algorithms and requires the entire input in memory, which is why their size limit is lower.
How to use file hash & checksum verifier
Choose a file from your device and the algorithm used by the publisher. File bytes stay in your browser.
Optionally paste the expected hexadecimal checksum or a single checksum-file line from a trusted source.
Calculate the checksum, review the comparison and any filename warning, then copy the digest or export a report.
Privacy and scope
All file processing takes place in a browser worker. No file content, filename, hash or expected value is sent to a server by this tool. Processing begins only when you click Calculate. SHA-256 and MD5 use small chunks; other algorithms have a lower memory-based size limit.
The tool does not save inputs in browser storage. Reset or leave the page to clear its in-page state. Downloads and clipboard copies remain wherever you save or paste them.
Frequently asked questions
Does my file leave my device?
No. The selected file is read by a worker in your browser. File bytes, filenames and checksums are not uploaded or saved by this tool. The worker is stopped when you cancel, reset, choose another file or leave this page.
Which algorithms and file sizes are supported?
SHA-256 and MD5 process files in 1 MiB chunks, up to 1 GiB per file. SHA-384, SHA-512 and SHA-1 use the browser’s Web Crypto implementation and are limited to 32 MiB because that API requires the entire file in memory. Only one file and algorithm run at a time. SHA-256 is the default.
Does a matching checksum prove a download is safe?
No. A matching digest means the selected bytes match the supplied checksum under that algorithm. Obtain the expected value from a trusted publisher or authenticated source. If an attacker can replace both the file and checksum, a match does not establish authenticity or absence of malware. Digital signatures provide a separate authenticity check.
Why are MD5 and SHA-1 marked as legacy?
These algorithms have known collision weaknesses and should not be selected for new security-sensitive integrity workflows. They are included for comparison with existing published legacy checksums. Prefer SHA-256 or stronger when the publisher provides it.
Can I paste a checksum file line?
Yes. Paste plain hexadecimal, a single GNU-style line such as hex followed by a filename, or a BSD-style line such as SHA256 (filename) = hex. Hexadecimal case is ignored. Multiple lines, the wrong length, an unsupported format or a conflicting algorithm label are rejected. A filename mismatch is reported separately from the byte-level checksum comparison.