File Checksum Calculator
This file checksum calculator computes SHA-256, SHA-1, SHA-384 and SHA-512 hashes of a file and compares them against a checksum you paste from a download page. That comparison is what tells you a download arrived intact and is genuinely the file the publisher built rather than something substituted along the way. The file is read directly by your browser and never uploaded, which matters more here than for most tools: checksumming is something you do to a file you have just downloaded and do not yet trust, so sending it to a server would defeat much of the point.
How it works
Computes the hash of a file so you can compare it against the checksum published alongside a download. That comparison is what tells you the file arrived intact and is the file the publisher actually built.
The file is read directly by your browser and never uploaded, which matters here more than usual: checksumming is something you do to files you have just downloaded and do not yet trust.
Everything runs in your browser using its own cryptography — nothing is sent to a server.
What a checksum does and does not prove
A matching checksum proves the bytes you have are the bytes that were hashed. That catches:
- A truncated or corrupted download.
- A file swapped in transit by a compromised mirror or network.
- Accidentally downloading a different version.
It does not prove the file is safe. If the publisher's own site was compromised, both the file and the published checksum change together and they will match perfectly. Only a cryptographic signature verified against a key you already trust addresses that.
Where to get the checksum
From the publisher's official download page, over HTTPS. A checksum published next to the file on the same compromised mirror is worth nothing — the value of the check comes from the two coming from different places.
MD5 is still published, and still weak
Plenty of projects still publish MD5 sums. MD5 is broken for security purposes: two different files with the same MD5 can be constructed deliberately. It remains fine as a check against accidental corruption, but if SHA-256 is offered, use that.
Frequently asked questions
How do I verify a download?
Choose the file, paste the checksum from the download page, and the tool says whether they match. A match means the file is byte-for-byte what the publisher hashed.
Is my file uploaded?
No. It is read directly by your browser and hashed locally — which matters, because verifying a download you do not yet trust by sending it to a server would be self-defeating.
Which algorithm should I use?
Use the one the publisher used, since that is what you have to compare against. If several are offered, SHA-256 is the sensible default.
What if the checksum does not match?
Do not use the file. It may be corrupt, incomplete, a different version, or deliberately altered. Download it again from the official source and re-check.
Does a matching checksum prove the file is safe?
It proves the file matches what the publisher hashed. If the publisher is malicious or their site was compromised, the checksum matches malware perfectly well. Signatures, not checksums, address that.
Is there a file size limit?
The file has to fit in your browser memory, so very large files may fail on a low-memory device. Several gigabytes is usually fine on a desktop.
Related tools
All Hash Generator (MD, SHA, CRC & more)
This hash generator computes MD5, SHA-1/256/512, SHA-3, RIPEMD-160, Whirlpool, CRC32 and NTLM hashes from text, instantly in your browser.
HMAC Generator
This HMAC generator signs a message with a secret key, using SHA-1 through SHA-512.
bcrypt Hash Generator & Verifier
This bcrypt generator hashes text with a configurable cost factor and verifies a value against an existing bcrypt hash, in your browser.