File Hash Verifier
When you download an installer, disk image, or firmware, the publisher often lists a checksum next to the link — a fingerprint of the exact bytes they released. This tool recomputes that fingerprint locally: your browser hashes the dropped file with the Web Crypto API (crypto.subtle.digest) using SHA-1, SHA-256, SHA-384, or SHA-512 and compares the result against the hash you paste in, ignoring case and whitespace. The file never leaves your machine — no upload, no server round trip. A green match proves integrity, not authenticity: the bytes are identical to what the publisher listed, which rules out truncated downloads, mirror corruption, and swapped files, but it cannot prove the checksum page itself wasn't tampered with — that requires a cryptographic signature. Prefer SHA-256 or stronger (SHA-1 is offered only because some projects still publish it), and expect multi-gigabyte files to take a moment, since the whole file is read into memory before hashing.
Whitespace and case are ignored when comparing — paste directly from the .sha256 file.
How to use
- Choose the algorithm the publisher lists (SHA-256 is the most common). Changing it later clears the loaded file, so re-drop the file to recompute.
- Paste the expected hash — just the hex digest, not the whole "hash filename" line from a .sha256 file.
- Drop the downloaded file, or click to pick one. Hashing runs locally; the file name, size, and computed digest appear below.
- Read the verdict: a green badge means the digests match, red means the bytes differ. With no expected hash pasted, you still get the computed digest for manual comparison.
Frequently asked questions
- Why should I verify a download at all?
- A hash mismatch catches truncated downloads, mirror corruption, and files swapped by a compromised mirror or proxy. Note that it proves integrity, not provenance: if an attacker controls the page that lists the checksum too, they can replace both. For provenance you also need a signature made with the project's key (GPG, Sigstore, etc.).
- Is the file uploaded anywhere?
- No. The browser reads the file and hashes it locally with the Web Crypto API; nothing is sent to any server. The whole file is loaded into memory to be hashed, so multi-gigabyte files take a while and can strain low-memory devices.
- Which algorithm should I pick, and why is there no MD5?
- Always use whatever the publisher lists — a SHA-256 digest will never match a SHA-512 one. SHA-256 is the de-facto standard today. SHA-1 is collision-broken and shouldn't back security decisions, though it still detects accidental corruption. MD5 is absent because browsers' Web Crypto API deliberately doesn't implement it.
- Can I paste the entire line from a .sha256 file?
- Paste just the hex digest. Spaces, line breaks, and letter case are ignored during comparison, but the trailing filename in sha256sum's "hash filename" format adds extra characters that will make the comparison fail.
- The hashes don't match — what should I do?
- Re-download the file first: an interrupted transfer is the most common cause. Also double-check that you picked the same algorithm and the checksum for the exact version and architecture you downloaded. If it still doesn't match, don't run the file — fetch it from the official source and report it to the project.
Related tools
File Hash (Checksum)
Compute SHA-1, SHA-256, and SHA-512 checksums of any file.
Hash Generator (SHA)
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
Bcrypt Hash & Verify
Generate bcrypt hashes with adjustable cost factor, or verify an existing hash against a password — runs entirely in your browser.
CSP Hash Generator
Compute the sha256 / sha384 / sha512 base64 hash an inline <script> or <style> block needs to be whitelisted by a Content-Security-Policy.
Bencode / .torrent Inspector
Drop any bencoded file (.torrent or raw bencode) and inspect its tree, info hash (SHA-1), trackers, file list, piece length, and creation metadata — all parsed locally in your browser.
STL 3D Model Inspector (Volume, Bed Fit)
Drop a .stl file (binary or ASCII) and instantly see triangle count, bounding box, X×Y×Z size, volume, surface area, watertight check, three orthographic preview projections, and whether it fits common 3D-printer beds (Bambu, Prusa, Voron, Ender).