Checksum Verifier
Check a downloaded file against its published checksum. Paste an MD5, SHA-1 or SHA-256 hash — or a whole SHA256SUMS file — and get an instant match or mismatch verdict.
Drag & drop the downloaded file(s) here, or click to browse
No uploads. Your files are read and hashed on your device.
Nothing pasted yet — files will show their computed hash.
Add a file to verify.
How it works
Drop the file you downloaded, paste the checksum the publisher listed next to it, and the
answer appears immediately: MATCH means the bytes on your disk are exactly the
bytes that were published, MISMATCH means the download is corrupted or has
been tampered with. You can paste a bare hash, a full SHA256SUMS file
(hash filename per line, # comments and *
binary markers included) or BSD-style SHA256 (file) = hash lines, and you can drop
several files at once — each one is matched to its line by filename.
The algorithm is detected from the length of the hash you paste (32 hex characters is MD5, 40
is SHA-1, 64 is SHA-256, 96 is SHA-384, 128 is SHA-512), so you normally never touch the
dropdown. SHA digests come from the browser's built-in Web Crypto
(crypto.subtle.digest); MD5 is not part of Web Crypto, so it is computed by a small
RFC 1321 implementation running in the same page. Comparison ignores case and stray spaces,
colons or line breaks. Nothing is uploaded — the file never leaves your device, which is what
makes this safe for installers, ISOs, backups and private archives. Remember that a matching
MD5 or SHA-1 proves the download is intact but is weak against a deliberate attacker; prefer
SHA-256 when the publisher offers it.
Frequently asked questions
How do I verify a downloaded file's checksum?
Drop the file you downloaded into the box, then paste the checksum the publisher listed next to the download link. The tool hashes the file on your device and compares the two straight away: MATCH means the bytes on your disk are exactly the bytes that were published, MISMATCH means they are not. You can also paste a whole SHA256SUMS or CHECKSUM file — hash-and-filename lines, # comments and * binary markers are all understood — and drop several files at once, and each file is matched to its own line by filename.
Which algorithm should I pick — MD5, SHA-1 or SHA-256?
You normally do not pick one at all: the algorithm is detected from the length of the hash you paste, because 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. Use whichever hash the publisher provides, and prefer SHA-256 when several are offered. MD5 and SHA-1 still prove a download is complete and uncorrupted, but they are broken against a deliberate attacker, so they should not be your only integrity check for security-sensitive software. The dropdown lets you force a specific algorithm if you ever need to.
What does it mean if the checksum does not match?
It means the file on your disk is not the file that was published. Nine times out of ten that is an incomplete or corrupted download, a mirror serving an older release, or a hash copied from the wrong version — download it again from the official source and re-check. If it still fails, treat the file as untrusted rather than running it. Also check the obvious traps first: make sure you pasted the hash for that exact file, and note that comparison here ignores letter case, spaces, colons and line breaks, so formatting is never the cause.