File hash / checksum

A checksum is a short fingerprint calculated from every byte of a file. If even one bit changes, the checksum changes completely. Software publishers list SHA-256 checksums next to downloads so you can confirm the file you received is exactly the one they published, not corrupted in transit or replaced by an attacker. This tool computes checksums locally, without uploading the file.

How to use it

1. Select or drop a file.
2. Wait for the hashes to be calculated.
3. Compare the result with the checksum published by the vendor.

Example

A Linux ISO page lists SHA256: 3b2f...a91c. If the SHA-256 shown here matches exactly, the download is intact. If a single character differs, delete the file and download it again from the official source.

Which algorithm?

• SHA-256: the standard choice for verifying downloads and integrity today.
• SHA-512: also secure; sometimes faster on 64-bit CPUs.
• SHA-1 and MD5: still fine for detecting accidental corruption, but broken against deliberate tampering, because attackers can create collisions.

Command-line equivalents

• Linux: sha256sum file.iso
• macOS: shasum -a 256 file.iso
• Windows PowerShell: Get-FileHash file.iso -Algorithm SHA256

Important limitation

A checksum only proves the file matches the published value. If an attacker controls the website, they can change both the file and the checksum. For stronger assurance, verify a GPG signature or get the checksum from a separate trusted channel.

Files are read in your browser and never leave your computer.