File checksum checker

Nothing you paste or drop here leaves your browser. Files are read in pieces by a background worker, so a 4 GB ISO is fine.

This file checksum tool checks a download against the checksum its publisher gave you. Paste the checksum, drop the file, and a green tick means your copy matches exactly. It works out the algorithm from the checksum's length, handles whole SHA256SUMS lists, and hashes the file right in your browser. Nothing is uploaded.

Using it

Download the file and find the checksum on the download page. It's often next to the link, in a file called SHA256SUMS, or in the release notes. Paste it in the top box and drop the file below. A green tick means the SHA-256 of your copy (or whichever algorithm fits the checksum's length) is exactly the number you pasted. A red cross means it isn't, and the first character that differs is highlighted so you can tell a mistyped checksum from a damaged file.

You can also paste a whole checksum file and drop several files at once. The tool reads both common layouts, GNU (hash filename, with * for binary mode) and BSD (SHA256 (filename) = hash), matches each dropped file to its line by name, and tells you about files that aren't in the list. A Subresource Integrity string such as sha384-… works too. If you paste nothing, it just shows the file's SHA-256.

How it guesses the algorithm

A digest's length gives it away, because each algorithm has a fixed output size. When more than one algorithm has that length, the tool tries all of them and tells you which one matched.

If you already know the algorithm, pick it from the list and the tool won't try the others. For a 64-character checksum it shows you the SHA-256 when there's no match, because that's by far the most common.

What a match proves, and what it doesn't

A match proves your copy is bit-for-bit what the checksum describes. It doesn't prove the checksum is honest. If an attacker can replace the file on the download server, they can usually replace the checksum on the same page, and the tick tells you nothing. A checksum helps most when it reaches you by a different route from the file, such as a signed announcement, a package manager's metadata, or a checksum a person gave you. A signature (GPG, minisign or sigstore) ties the file to a key the publisher holds, which a checksum on the same web page can't do. The guide to verifying downloads goes through all of this, with the commands for Windows, macOS and Linux.

If you're not sure which algorithm a checksum came from, the hash identifier reads it from the length and format. A match with MD5 or SHA-1 is weaker still. Someone who controls the original file can craft a different one with the same MD5 or SHA-1, so those matches only show the file wasn't damaged in transit. The tool tells you when that's what matched.

Checking it on the command line

You don't need this page to verify a file. These commands print the digest so you can compare by eye, or check a whole list for you:

# macOS
shasum -a 256 ubuntu.iso
# Linux: print one, or check every line of a list
sha256sum ubuntu.iso
sha256sum -c SHA256SUMS --ignore-missing
# Windows, PowerShell, then Command Prompt
Get-FileHash .\ubuntu.iso -Algorithm SHA256
certutil -hashfile ubuntu.iso SHA256

They give the same digests the hash generator shows, for text and for files. To compare two digests you already have in hand, use the hash comparer, which ignores case, spaces and colons.

Common questions