File Hash Checker
Calculate and verify SHA-256, SHA-512 file checksums
File Hash Checker tool
File Hash Checker: key facts
- What it does
- Calculate and verify SHA-256, SHA-512 file checksums
- Category
- Security
- Cost
- Free, with no account, sign-up, or install.
- Your data
- Runs entirely in your browser — the files and text you enter are never uploaded to a server.
- Last reviewed
- . Report an incorrect result.
About the File Hash Checker
Every time you download software, an OS image, or a sensitive document, you are trusting that the file arrived intact and unmodified. Cryptographic hashing gives you a way to verify that trust: the publisher computes a hash of the original file and publishes it, and you recompute the hash on the file you received. A single corrupted byte produces a completely different hash, making tampering or transfer errors immediately visible.
This file hash checker computes SHA-1, SHA-256, SHA-384, or SHA-512 checksums directly in your browser using the native Web Crypto API — no upload, no server, no size limit beyond available RAM. Security engineers use it to verify ISO images before flashing, developers use it to confirm npm tarball integrity, and auditors use it to create tamper-evident fingerprints of files in an evidence chain.
How to use it
- Drag your file onto the drop zone or click "Browse" to select it from disk.
- Choose the hashing algorithm from the four buttons — SHA-256 is the most common for software verification; SHA-512 provides a longer fingerprint for higher-assurance scenarios.
- The hash calculates automatically; copy it with the clipboard button.
- Optionally paste the expected hash from the publisher into the verification field. The tool immediately reports "Match" (green) or "No Match" (red).
Hashing a file in the browser
The file is read into memory as a byte buffer and digested through the browser's Web Crypto implementation, offering SHA-1, SHA-256, SHA-384, and SHA-512. The file is never uploaded — the bytes are read locally and the digest computed on your own machine, which is what makes it safe to hash something confidential.
Comparison is the usual purpose. Paste the publisher's expected digest alongside and the tool tells you whether they match, which is a considerably more reliable check than reading two 64-character strings by eye.
Because the whole file is held in memory, very large files are limited by available memory rather than by any restriction here.
- SHA-256 is the algorithm most software publishers quote for downloads.
- A single altered byte anywhere in the file changes the digest completely.
- Two files with the same digest under SHA-256 are, for practical purposes, the same file.
Why use this version
- The file never leaves your device. The Web Crypto API processes the file buffer in browser memory, which means even confidential documents stay fully private during verification.
- All four current SHA-2 variants are supported in a single tool. Switching algorithms is one click and recalculates instantly without re-uploading.
- The comparison is case-insensitive and trims whitespace, eliminating the most common causes of false "no match" results when copying hashes from terminals or emails.
- There is no file size restriction. Unlike server-based tools that cap uploads at a few hundred megabytes, this tool handles multi-gigabyte ISO and virtual disk files limited only by your browser's available memory.
What a matching digest actually proves
It proves the file you have is the file whose digest you were given. That is genuinely useful — it catches truncated downloads, corrupted transfers, and disk errors — but it is a narrower guarantee than it appears, because it depends entirely on where the expected digest came from.
If the digest is published on the same page as the download, an attacker who can alter the download can alter the digest, and the check confirms nothing. That is why the checksum's channel matters: a digest from the project's signed release notes, a different domain, or a package manager's own metadata carries real weight. For genuine authenticity you want a cryptographic signature — GPG for source releases, or the code-signing built into operating systems — which proves who produced the file rather than merely that it is unchanged.
Prefer SHA-256 or above. A published MD5 or SHA-1 checksum still detects accidental corruption, but neither resists deliberate collision construction, so neither should be trusted against a motivated adversary.
Frequently Asked Questions
What is a file hash or checksum?
A hash is a fixed-length fingerprint produced by a mathematical function that takes an entire file as input. The same file always produces the same hash; any change — even flipping a single bit — produces a completely different hash. Publishers use this to let recipients confirm a downloaded file is identical to the original.
Which algorithm should I use?
SHA-256 is the current standard for most software distribution and is required by many certificate authorities. SHA-512 offers a longer fingerprint (512 bits vs 256 bits) and is preferred in high-assurance environments. SHA-1 is legacy — use it only when a publisher provides only a SHA-1 hash, as it is no longer considered collision-resistant for new applications.
Can I recover the original file from its hash?
No. Hashing is a one-way function by design. A hash uniquely identifies a file but contains no information about its contents. This is fundamentally different from encryption, which is reversible with the correct key.
Why does my hash not match the expected value?
The most common causes are: a corrupted or incomplete download (re-download the file), copy-paste of only part of the expected hash (check for missing leading zeros), or a mismatch between hash algorithm (verify the publisher specifies SHA-256 not SHA-1). Ensure you are hashing the exact same file the publisher measured, not a re-compressed or renamed version.
