File Checksum Generator
MD5, SHA1, SHA256, SHA512 for uploaded files
100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.
Click or drag a file here
Any file type supported
About this tool
A checksum is a fixed-length fingerprint computed from a file's contents, with one crucial property: changing a single bit produces a completely different result. That makes it a reliable way to answer "is this file exactly what it should be" - which matters after a download over an unreliable connection, and matters far more when the file is an installer or a disk image. Publishers list the expected checksum precisely so you can verify what arrived. Algorithm choice matters for the second case. MD5 and SHA-1 are both cryptographically broken: attackers can deliberately construct two different files with the same hash, so a matching MD5 no longer proves a file has not been tampered with. Both are still fine for detecting accidental corruption, which is a different question. For any verification where a malicious substitution is the concern, use SHA-256 - and prefer the checksum published on a different channel from the file itself. Hashing runs in your browser.
How to use this tool
- Select your fileIt is read locally - large files are hashed in chunks so browser memory is not a limit.
- Pick the algorithmMatch whichever the publisher listed. SHA-256 is the right choice when you have one.
- Compare with the published valueThey must match exactly and completely. A partial match means nothing.
- Treat a mismatch as a failureDo not run the file. Re-download it, and if it still differs, be suspicious of the source.
How to verify a download with a checksum
Download the file, generate its SHA-256 checksum here and compare it with the one published on the official download page. If every character matches, the file is exactly what the publisher released; if even one differs, delete it and download again.
Get the published checksum from the official site over HTTPS, not from the same mirror the file came from. Prefer SHA-256 over MD5 or SHA-1 where it is offered.
Key features
- Runs in your browser - files are never uploaded, which matters for anything confidential.
- Four algorithms, so you can match whatever the publisher provided.
- Handles large files by hashing in chunks rather than loading everything into memory.
- No file size limit imposed by a server.
- No account required.
Common uses
- Verifying an ISO or installer download before running it.
- Confirming a large file transferred intact across a network or drive.
- Checking two files are identical without comparing them byte by byte.
- Recording a hash so you can prove a file has not changed later.
- Detecting silent corruption in a backup or archive.
Tips for better results
- Use SHA-256 wherever the publisher offers it. MD5 and SHA-1 remain useful for corruption checks but not for tamper detection.
- Compare the whole string. Checking the first and last few characters is exactly what an attacker constructing a collision would rely on.
- Get the checksum from a different source than the file - a checksum hosted next to a compromised download is worthless.
- A mismatch is a stop signal, not a warning. Do not run the file.
- For verifying authenticity rather than integrity, a signature such as GPG is stronger than any checksum.
Mistakes to avoid
- Treating a matching MD5 as proof a file is safe. MD5 collisions can be deliberately constructed.
- Comparing only the start and end of the hash rather than the whole value.
- Downloading the checksum from the same compromised page as the file.
- Running an installer anyway after a mismatch, assuming the download was merely flaky.
- Confusing a checksum with encryption or a signature - it proves sameness, not secrecy or origin.
Frequently asked questions
Many software publishers provide the expected checksum alongside a download - comparing it against the checksum of your actual downloaded file confirms it wasn't corrupted during download or tampered with by a compromised mirror/server.
No - the checksum is computed directly in your browser; the file itself isn't uploaded anywhere.
Whichever the publisher listed, so you have something to compare against. Given a free choice, SHA-256 - it is the current standard and the only one of the four with meaningful collision resistance.
For detecting accidental corruption, yes. For proving a file has not been tampered with, no - MD5 collisions can be deliberately constructed, so a matching MD5 does not rule out a substituted file. SHA-1 has the same problem.
Do not run the file. Re-download it, since the usual cause is an interrupted or corrupted transfer. If it still differs after a clean download, treat the source as untrustworthy rather than assuming another glitch.
Yes. Files are read and hashed in chunks rather than loaded whole into memory, so multi-gigabyte ISOs work - they just take proportionally longer, since the work happens on your device.
Download the checksum list from the official site, compute the SHA-256 of your download here and compare. If the project also signs the checksum file, verifying that signature confirms the list itself is genuine.
Yes. Record checksums of important files when you back them up and compare later - a mismatch reveals silent corruption that a file size check would miss.
Because they are not identical: a re-download from a mirror with a different version, a file converted to different line endings, or edited metadata all change the bytes and therefore the hash.