Check a file's MD5 or SHA-256 checksum

Get a file's checksum on your device and compare it with the one the publisher lists.

Computes the MD5, SHA-1 or SHA-256 checksum of a file so you can compare it with the one the publisher lists. It is free, needs no account and adds no watermark, and your files are not uploaded: everything runs in your browser on your device. The size limit is your device’s memory, and phones hold less; give the page a short while after your first run to save itself for offline use, and then it works offline.

Drop files to checksumor click to choose files. Batches welcome.
    Working…

    Done

    Your files are processed on this device and never sent to a server. Reload the page to clear everything from memory.

    How it works

    1. Drop a file, or several, or tap to pick them. Nothing is uploaded.
    2. Press Calculate checksums. A large file takes a while; a progress bar shows how far it has got.
    3. Paste the checksum the publisher gave you into the compare box to see whether it matches. Copy any value with its Copy button.

    In your browser, not on a server

    hash-wasm (MIT), a small hashing library compiled to WebAssembly, computes MD5, SHA-1 and SHA-256 together while the file is read from your disk in 8 MB pieces, so only one piece is in memory at a time and the file is never loaded whole. The three digests are written as lowercase hexadecimal. The compare box strips spaces and ignores capital letters before it checks the pasted value against each digest.

    Compared with upload-based tools: Plenty of online hash tools upload the file, or ask you to install something. Here the file is read by this tab and hashed on your device, so checking a private download does not share it. Very large files are limited by your device’s memory and patience, not by a cap on this page.

    Verify it yourself. Give the page a short while after your first run to save itself for offline use, then turn off Wi-Fi or switch to airplane mode and run the tool again. Or open your browser's developer tools (F12, or Cmd-Option-I on a Mac), pick the Network tab, and watch it while you convert. The panel above does the same count for you.

    Questions

    How do I check a file's checksum?

    Drop the file and press Calculate checksums. You get its MD5, SHA-1 and SHA-256 values; use whichever one the download page lists. Paste the published value into the compare box and it says whether it matches, and which algorithm matched. Capital letters and spaces in the pasted value do not matter.

    Is the file uploaded?

    No. The file is read by this tab and hashed on your device; only the page itself is downloaded. Neither the file, its name nor the checksums are sent anywhere.

    Is MD5 secure? Which should I use?

    No. MD5 is not secure against deliberate tampering, because attackers can craft two different files with the same MD5. It still catches accidental corruption, such as a broken download. If the publisher lists SHA-256, use that. A matching hash also does not prove a file is safe, only that it is the same file the publisher hashed, and that is only as trustworthy as where you got the checksum.

    What is the difference between MD5, SHA-1 and SHA-256?

    They are different algorithms that give different-length fingerprints: 128, 160 and 256 bits. The same file gives a different value in each, so compare like with like. MD5 and SHA-1 are broken for security use; SHA-256 is the usual choice.

    How do I get a checksum on Windows without installing anything?

    `certutil -hashfile <file> SHA256` in Command Prompt, or `Get-FileHash <file> -Algorithm SHA256` in PowerShell, give the same answer as this tool. Use MD5 or SHA1 in place of SHA256 for the other algorithms.

    Can it hash a very large file, like an ISO?

    It is built for large files: it reads the file in small pieces rather than loading it whole, so a multi-gigabyte ISO does not need that much memory. It is still bounded by your device. A phone or a low-memory computer may run out of memory or take a very long time, and then the page says so instead of giving a result. If that happens, use certutil, Get-FileHash or shasum on the file instead.

    More PDF tools

    Popular conversions

    Guides