File Checksum Verifier
Confirm a download is the file it claims to be. Nothing is uploaded — the hashing happens on your machine.
Held in memory to hash, so very large files may not fit.
Computed in your browser with the Web Crypto API. The file is never uploaded.
What a checksum proves
A checksum is a fixed-length fingerprint of a file's contents. Change a single byte and the fingerprint changes completely. Projects publish the expected hash next to a download so you can confirm that the bytes you received are the bytes they shipped — catching a corrupted transfer, a truncated download, a stale mirror, or a file that was tampered with in transit.
Paste the published value above and this will compare it for you, so you are not eyeballing 64 hexadecimal characters and hoping.
Which algorithm to use
- SHA-256 — the sensible default, and what almost every project publishes today.
- SHA-512 — same family, longer output. Often faster than SHA-256 on 64-bit machines.
- SHA-1 — still widely published, and still fine for spotting accidental corruption. It is broken for security: practical collisions have been demonstrated, so it cannot prove a file was not deliberately substituted.
- MD5 — thoroughly broken, and collisions are trivial to produce. Treat a matching MD5 as evidence the download did not corrupt, never as evidence the file is trustworthy.
MD5 is not offered here. The browser's crypto API deliberately does not implement it, and adding a third-party library to produce a hash nobody should be relying on would be the wrong trade — especially on a page whose whole premise is that nothing is uploaded and no outside code runs.
What it doesn't prove
A checksum only confirms the file matches the hash. If an attacker controls the page publishing the hash, they control both sides and the check proves nothing. That is what signatures are for: a GPG or Authenticode signature ties the file to a key you can verify independently. A checksum answers "did this arrive intact", not "should I trust whoever made it".
How to do this without a browser
On macOS or Linux: shasum -a 256 file. On Windows PowerShell: Get-FileHash file. Both produce the same value you will see here — this page exists for when you would rather not open a terminal, and for comparing against a pasted value without going cross-eyed.