Developer
Checksum Verifier
Check that a download is the file its publisher meant to send. Paste the checksum from the download page and the file is read in your browser — MD5, SHA-1, SHA-256 and SHA-512 all at once, so you do not have to know which one you are holding.
How to use it
- Drop the downloaded file onto the page, or choose it. It is read in your browser and not uploaded.
- Paste the checksum from the download page into the box — in whatever form you copied it.
- Wait for the file to be read. Large files take a moment; the progress line is real.
- Read the verdict. A match names which algorithm matched, and the filename if your paste carried one.
- If nothing matches, download the file again before assuming it was tampered with — an interrupted transfer is far more common.
How it works
A checksum is a short fingerprint computed from every byte of a file. Change one byte anywhere — a bit flipped in transit, a truncated download, an installer somebody swapped — and the fingerprint changes completely. Comparing the fingerprint of what you received against the one the publisher computed tells you whether you received the same bytes they sent.
The file is read in pieces and fed through four hash functions as it goes, so nothing larger than a few megabytes is ever held in memory. That matters because the files worth checking are the large ones: disc images, installers, archives. Your browser has hashing built in, but it requires the entire file in memory at once and offers no MD5, so this page carries its own implementation compiled to WebAssembly.
Which algorithm a pasted hash belongs to is worked out from its length. Among these four the lengths do not collide, so the identification is exact: 32 hexadecimal characters can only be MD5 here, 128 only SHA-512. A hash from an algorithm this page does not compute — SHA3-256, for instance, which is also 64 characters — will simply not match, which is the correct answer to give.
What a matching checksum establishes is narrower than it looks. It establishes that your copy is identical to the copy whose checksum you hold. It does not establish that the file is safe, or that the publisher is trustworthy, or that nobody has interfered — because an attacker able to alter the download can usually alter the checksum printed next to it. The check earns its keep when the checksum and the file came by routes that would have to be compromised separately: a hash from a distribution’s signed release notes, a mirror list, or a package manager, rather than from the same page that served the file.
Common questions
Is my file uploaded anywhere?
No. The file is read from your disk by your own browser and hashed there. Nothing is sent — which is also why the size of the file does not matter to us, and why this works with no network connection at all once the page has loaded.
Which checksum should I use?
Use whichever the publisher gave you — that is the only one you can compare against. If they offer a choice, take SHA-256. MD5 and SHA-1 are still fine for spotting a download that arrived damaged, but both have been broken in the sense that matters for tampering: two different files can be constructed to share a hash.
The checksum matches. Is the file safe?
It means the file is the one that checksum describes, and nothing more. If an attacker replaced the download, they could usually replace the checksum on the same page too, and you would get a match. A checksum is worth most when you got it somewhere other than where you got the file. What actually establishes who published something is a signature — GPG or similar — which this tool does not check.
Why does it show four hashes instead of asking me which one?
Because asking would mean you had to already know. The string on a download page is often unlabelled, and its length is enough to identify it among these four: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256, 128 is SHA-512. Reading the file once and hashing it four ways costs a little processor time and saves you guessing.
Can it handle a 4 GB disc image?
Yes. The file is streamed through the hash in pieces rather than loaded into memory, so size is limited by patience rather than by RAM. Expect roughly 80 MB a second for all four hashes together, which puts a 4 GB disc image at around a minute — rather less time than downloading it took. The browser’s own built-in hashing cannot do this at all: it requires the whole file in memory at once and has no MD5, which is why this page carries its own.
My hash is 56 or 96 characters and nothing matches.
Those are SHA-224 and SHA-384, which this does not compute. They are rare on download pages. If a publisher uses one, the command line tools shasum -a 224 and shasum -a 384 will produce them.