File Checksum Verifier

How to use

1. 1Copy the published checksum from the project's download page or release notes and paste it into the Expected hash field. Almost any format works: a bare hex string, 'sha256:abc...', 'SHA256 (file.iso) = abc...', or 'abc... *file.iso'.
2. 2The algorithm is picked automatically from the length of the pasted hash. Override it with the Algorithm dropdown if the publisher uses a non-standard format or you just want to compute a digest of any file.
3. 3Drop the downloaded file onto the file area, or click to choose it from your computer. Files up to 4 GB are supported and are hashed entirely in your browser.
4. 4Read the result. A green Match panel means the file is identical to what the publisher signed off on. A red No match panel means the digests differ, so re-download the file or check that the published hash uses the same algorithm.
5. 5Copy the actual hex or base64 digest from the result panel with the Copy button if you need it for a bug report, an SBOM entry, or a different verification flow.

About this tool

File Checksum Verifier answers the everyday question 'I downloaded this file and the project page published a hash, did I get the right file?' Paste the expected hash from the publisher's download page, drop the file you downloaded, and the tool tells you immediately whether they match. The algorithm is auto-detected from the length of the hex string you paste (32 characters means MD5, 40 means SHA-1, 64 means SHA-256, 96 means SHA-384, 128 means SHA-512), so most of the time you just paste the published value and drop the file with no extra configuration. Common wrappers used by publishers are stripped automatically: the leading 'sha256:' prefix Docker and many container registries use, the 'SHA256 (filename) = ...' format produced by BSD checksum tools, the 'hash *filename' format produced by GNU md5sum and sha256sum, and any surrounding whitespace, so a copy-paste from almost any source works first time. The comparison is case-insensitive (the published hash may be uppercase or lowercase, the spec does not care) and is performed in a constant-time loop so the result is purely structural. SHA-1, SHA-256, SHA-384, and SHA-512 are computed by the browser's native Web Crypto API (crypto.subtle.digest), which is hardware-accelerated on every modern desktop and mobile CPU and produces digests that are byte-for-byte identical to what TLS, package managers, the Linux sha256sum command, and the standard libraries of Python, Java, .NET, Go, Rust, and Node.js produce. MD5 is not in Web Crypto in any browser, so this tool ships its own RFC 1321 implementation, which is the same algorithm used by Linux mirror trees, vendor download pages, and the GNU md5sum command, and is verified against the standard MD5 test vectors. Files up to 4 GiB are supported, which is the maximum single ArrayBuffer size on every modern desktop browser. Useful for verifying Linux ISO downloads, Docker image tarballs, language runtime installers (Node.js, Python, Java, Go), database backups, BIOS and firmware updates, large research datasets, downloaded video assets, contracts signed at the bytes level, and anything else where the publisher tells you 'the SHA-256 of this file should be X' and you need to confirm it before opening or installing. Everything runs entirely in your browser: the file is read into memory from disk, hashed in place, and the bytes are released as soon as the digest is ready. Nothing is uploaded, no server sees the file, no cookies or trackers are involved.

Free to use. Works in your browser. No signup, no login.