Checksum Verifier
Paste the checksum a publisher gave you, pick your file, and see instantly whether they match.
Processed on your device — no upload
The file is read by this page and hashed by your browser's own crypto engine. A verifier that uploads your file has already defeated the point: you would be trusting the very connection you are trying to check.
How to use it
- Paste the published checksum.
- Choose the file you downloaded.
- Read the verdict.
How it works
A checksum is the output of a hash function: a fixed-length fingerprint of a file's exact bytes. Change one bit anywhere in a four-gigabyte ISO and roughly half the fingerprint changes. That is the whole mechanism — if your file produces the same fingerprint the publisher listed, you have their file.
The algorithm is written into the checksum itself. Each function produces a digest of a fixed length, and the lengths do not overlap: 32 hexadecimal characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512. This page counts the characters and selects the algorithm for you, which removes the step people most often get wrong.
Paste format does not matter. A bare digest, one in capitals, one broken into groups with spaces or colons, or a complete sha256sum line with the filename after it — all of them are reduced to the digest before comparison.
SHA-256 and SHA-512 come from the browser's Web Crypto engine. MD5 and SHA-1 are implemented in this page because publishers still list them, not because they are safe: both have practical collision attacks, meaning an attacker can construct a different file with the same digest. They confirm a download completed. They do not prove nobody tampered with it.
A worked example
A concrete run. Ubuntu publishes SHA256SUMS next to each release. You download ubuntu-24.04.1-desktop-amd64.iso, copy the 64-character digest from that file, paste it above and pick your ISO. The algorithm switches to SHA-256 on its own, your browser hashes 5.7 GB in a few seconds, and you get one line: match or no match.
What a mismatch usually means. Nine times out of ten the download was interrupted and resumed badly, or you are holding a different version — point releases reuse the filename far more often than people expect. Check the digest came from the page for exactly your build before assuming anything sinister.
Where the length warning earns its keep. Paste a 40-character SHA-1 digest and select SHA-256 by hand and you get a mismatch that looks like a corrupt file. This page recognises the length, tells you the two can never match, and says so instead of showing a red cross.
Why an upload-based verifier is self-defeating. The reason to check a checksum is that you do not fully trust how the file reached you. Sending that file to a third-party server to be hashed means trusting a second stranger, on a second connection, and waiting an hour to upload five gigabytes. Your browser already has a hash engine built in.
To produce a checksum rather than check one — for a file you are publishing, or to compare two copies of your own — use the hash generator.
Questions
Is my file uploaded?
No. The file is read by this page and hashed by your browser. Nothing is transmitted, which is the only sensible way to verify a download you are unsure about.
How do I know which algorithm to use?
You do not have to. The digest length identifies it: 32 characters is MD5, 40 SHA-1, 64 SHA-256, 128 SHA-512. This page detects it and you can still override it.
The checksums do not match. Is the file dangerous?
Usually it means the download was interrupted or you have a different version. Download it again from the original source and check once more before drawing conclusions.
Does a matching checksum prove the file is safe?
It proves the file matches what the publisher listed. If an attacker controls the page that publishes both the file and the checksum, they control both. It verifies integrity, not trustworthiness.
Why is MD5 still offered if it is broken?
Because many projects still publish MD5 checksums. It is fine for detecting a corrupted transfer and useless against a deliberate attacker, since a matching file can be constructed.
Can I verify a very large file?
Yes. Multi-gigabyte files work — the file is read by the browser rather than loaded over a network. Expect a few seconds per gigabyte.
What if the publisher gives a GPG signature instead?
That is a stronger check and this tool cannot do it, because it needs the publisher’s public key. Use GnuPG for signatures; use this for plain checksums.
Does the comparison leak anything through timing?
The comparison is constant-time regardless of where the first difference falls. It is overkill for a public checksum, but it costs nothing and the same box may hold something private.