File Checksum Calculator

A checksum is a short fingerprint computed from the exact bytes of a file. Change a single byte and the checksum changes completely, which is why software publishers print one next to every download. Drop a file on this checksum calculator and it returns four digests at once (MD5, SHA-1, SHA-256 and SHA-512), so whichever algorithm the publisher used, the value you need to compare is already on screen. The file is hashed inside your browser by Rust compiled to WebAssembly and is never uploaded.

What a checksum tells you (and what it does not)

If the checksum you compute matches the one published by the source, your copy is bit for bit identical to theirs. If it differs, something changed: the download was truncated, the file was corrupted on a disk or USB stick, or someone swapped it. A checksum only depends on content. Renaming a file or changing its modification date does not change it, while re-saving or re-compressing it almost always does.

A matching checksum proves integrity, not trust. If an attacker controls the download page, they can publish a matching hash for a malicious file. That is why many projects also sign their checksum files with GPG. For everyday use, comparing a SHA-256 against the value on the official site (over HTTPS) catches corruption and most tampering.

Common reasons to calculate a file checksum

• Verify a download: confirm that an ISO image, installer or firmware file matches the hash on the vendor's page before you run or flash it.
• Check a copy or transfer: compare the checksum before and after copying to an external drive, NAS or cloud folder to rule out silent corruption.
• Find duplicates: two files with the same SHA-256 have the same content, even if their names differ.
• Prove a file did not change: record the checksum of a contract, backup or release artifact today and recompute it later.
• Build an integrity manifest: hash a set of deliverables in one batch and export the list as CSV or JSON to ship alongside them.

MD5, SHA-1, SHA-256 or SHA-512: which checksum to use

The tool always computes all four, so the choice only matters when you decide which one to trust or publish. You can tell them apart by length: the output is lowercase hexadecimal of a fixed size.

• MD5 (32 hex characters): fast and still common on older download pages. Fine for spotting accidental corruption, but collisions can be crafted on purpose, so do not rely on it against an attacker.
• SHA-1 (40 hex characters): stronger than MD5 but also deprecated for security after practical collision attacks. Mostly useful to match legacy checksums.
• SHA-256 (64 hex characters): the default choice today. Most Linux distributions, open source projects and package registries publish SHA-256, and it is the value shown in batch mode.
• SHA-512 (128 hex characters): same SHA-2 family as SHA-256 with a longer digest. Use it when a source publishes it or when your own process requires it.

Rule of thumb: if a publisher offers several hashes, compare SHA-256 or SHA-512. Use MD5 only when it is the only value available.

How to verify a download against a published hash

1. Find the official checksum. It is usually printed on the download page or in a file named SHA256SUMS, checksums.txt or filename.sha256.
2. Drop the downloaded file on the drop zone above. All four digests appear as soon as hashing finishes.
3. Pick the line that matches the published algorithm (identify it by length if the page does not say).
4. Copy the value with one click and paste it next to the published one, or compare the first and last few characters carefully. Upper and lower case do not matter: A3F1 and a3f1 are the same hex value.

Identical values mean the file is intact. Any difference means you should delete it and download again, ideally from a different mirror.

Compare two files or hash a whole batch

Select or drop several files at once. The first file's four digests are shown in full, and a table lists every file with its status and SHA-256. To check whether two files are identical, drop both and compare their SHA-256 values in the table. The Export CSV and Export JSON buttons save one row per file containing the file name, status, any error, and all four digests (md5, sha1, sha256, sha512), which makes a ready-made integrity manifest.

Large files

Each file is read into browser memory and hashed in one pass, so the tool accepts files up to 500 MB each. Larger files are listed with an error instead of freezing the tab. For multi-gigabyte disk images, the command-line tools below stream the file from disk and are the better fit.

Command-line equivalents

Every desktop OS ships with a checksum command. They produce the same digests as this tool, which is handy for double-checking a result or automating it in a script.

• Windows (Command Prompt): certutil -hashfile file.iso SHA256 (also accepts MD5, SHA1 and SHA512).
• Windows (PowerShell): Get-FileHash .\file.iso -Algorithm SHA256. PowerShell prints the hash in uppercase, which is equivalent.
• macOS: shasum -a 256 file.dmg for SHA-256, or md5 file.dmg for MD5.
• Linux: sha256sum file.iso, or sha256sum -c SHA256SUMS to check every file listed in a checksum file.

The browser version is useful when you are on a locked-down machine, do not remember the syntax, or want MD5, SHA-1, SHA-256 and SHA-512 side by side without running four commands.

No upload: the file stays on your device

Many "online checksum" sites upload your file to a server to hash it. Here, hashing runs in your browser tab through WebAssembly and no network request carries the file. You can confirm it in the Network tab of your browser's developer tools, or disconnect from the internet after the page loads and keep hashing. That matters because the files people verify are often sensitive: internal builds, backups, signed contracts, or software you do not want copied to an unknown service.

FAQ

What is the difference between a checksum and a hash?

In practice they mean the same thing here: a fixed-length fingerprint computed from file content. "Checksum" is the usual word when verifying file integrity, "hash" is the general term. To hash a piece of text instead of a file, use the hash generator.

Which checksum should I use to verify a download?

SHA-256 in nearly every case. It is what most publishers provide and it remains secure against deliberate tampering. MD5 is only good for catching accidental corruption.

Why does my checksum not match the one on the website?

Either the file changed (incomplete download, corrupted copy, wrong version) or you are comparing different algorithms. Check that you compare SHA-256 with SHA-256, that you downloaded the exact file name listed next to the hash, and download again if it still differs.

Does renaming a file change its checksum?

No. The checksum is computed from the bytes inside the file, not its name or dates. Editing, re-saving or re-compressing the file does change it.

Are my files uploaded?

No. The digests are computed locally with WebAssembly. Nothing is sent, logged or stored.

Is there a file size limit?

Yes, 500 MB per file, because each file is held in browser memory while it is hashed. There is no fixed cap on the number of files in a batch, and no sign-up.

Related tools: bundle several files into one archive with the ZIP compressor and extractor, or browse all file tools.