File hash & checksum generator

SHA-256, SHA-1 and MD5, computed in your browser.

Checksums

SHA-256Copy

0000000000000000000000000000000000000000000000000000000000000000

The current standard. Use this one unless the publisher gave you something else.

SHA-1Copy

0000000000000000000000000000000000000000

Still widely published. Collisions have been demonstrated, so it proves a download is not corrupted, not that nobody tampered with it.

MD5Copy

00000000000000000000000000000000

Old and thoroughly broken against a deliberate attacker. Fine for spotting a truncated or corrupted download, which is what most published MD5 lines are for.

Compare against the published hash

Paste what the publisher gave you. A whole line from a checksums file is fine — the hash is picked out of it.

Work out the SHA-256, SHA-1 and MD5 of a file, and check it against the hash a publisher gave you. Useful for confirming a download arrived intact, or that two copies of a file really are the same.

Your file is never uploaded. It is read by this page, on your device, and hashed there. Nothing is sent to us or to anyone else — no request leaves the browser while it works, which you can confirm in your own network tools. Most checksum sites upload your file to a server to do this; there is no reason to, so this one does not.

How to verify a download

1. 1

   Find the hash the publisher gave you. It is usually next to the download link, or in a file called SHA256SUMS, checksums.txt or similar. If the project offers a choice, take the SHA-256 — it is the one worth trusting.

2. 2

   Hash the file you actually downloaded. Drop it into the box above. Nothing is sent anywhere; your browser reads the file off your disk and does the arithmetic locally.

3. 3

   Paste the published hash into the compare box. You can paste the whole line from a checksums file — the hash is picked out of it. Case does not matter.

4. 4

   Match means the bytes are identical. Not one bit differs from what the publisher hashed. No match means the file you have is not that file: an interrupted download, a mirror serving something stale, or in the worst case something you should not run.

A hash tells you whether two files are byte-for-byte the same. It cannot tell you whether the publisher is trustworthy, and it is only as good as where you got the expected hash from — if both the file and the hash come from the same compromised page, they will agree with each other. For downloads where that matters, prefer a signature over a checksum.

Read more about this

• How to verify a download with SHA-256 →

  A digest published beside the download proves less than people think. Here is what it is good for.

Frequently asked questions

Is my file uploaded anywhere?

No. The file is read by your own browser and hashed on your device. There is no upload, no server request, and no copy of it anywhere but your disk. You can disconnect from the network and the tool still works.

How large a file can I hash?

There is no fixed limit. The file is read in small pieces rather than loaded into memory all at once, so a multi-gigabyte file uses about as much memory as a small one. Very large files simply take longer.

Which algorithm should I use?

SHA-256 unless the publisher gave you something else. SHA-1 and MD5 are offered because a great deal of software still publishes them, but both are broken against a deliberate attacker: they will tell you a download is not corrupted, and they will not tell you that nobody tampered with it.

The hash does not match. What does that mean?

The file you have is not the file the publisher hashed. The usual cause is a download that was interrupted or a mirror serving an older build, so downloading again is the first thing to try. If a fresh download from the official source still does not match, do not run the file.

Why do I get a different hash from sha256sum?

You should not — the same bytes give the same digest everywhere. If they differ, the two are almost certainly not looking at the same file: check you hashed the file you think you did, and that the download finished. Note that the hash covers the file contents only, so renaming a file never changes it.

Does this work offline?

Yes. Mubifiles installs as an offline-capable app, and this tool needs no network at all once the page has loaded, because all the work happens in your browser.