HASH & CHECKSUM

Verify a download without uploading it

Compute MD5, SHA-1, SHA-256, SHA-512, BLAKE3 or CRC32 for a file and compare it against a published checksum. Files are read in chunks, so a multi-gigabyte ISO hashes without ever being held in memory, and nothing is sent anywhere.

Drop the file to checkAny file, any size. It is read in chunks and never uploaded.Choose a file

Expected checksum

Paste the whole line if you like. A file name, extra spaces, upper case and the SHA256 (file) = … form are all understood. Only the digest is read.

Algorithm

What a matching checksum does and does not tell you

A match means the file you have is byte-for-byte the file whose checksum was published. It does not mean the file is safe. If the page that published the checksum was compromised, the checksum was published by whoever compromised it. A checksum verifies integrity, not trust.

MD5 and SHA-1 are both broken against a determined attacker: a deliberate collision is practical, so a match proves the file was not corrupted in transit, not that nobody chose those bytes on purpose. Use SHA-256 where the publisher offers it. CRC32 is not a hash at all. It is an error check, and forging one takes seconds.