🧾 File Hash Checker
Drop in a file, get its SHA-256 fingerprint, paste the publisher's checksum, matching hashes prove the download arrived bit-for-bit intact.
How the file hash checker works
The file is read into memory and digested with the Web Crypto API, the browser's native, correct implementation of the SHA-2 family. A hash is a fixed-size fingerprint: SHA-256 always produces 256 bits (64 hexadecimal characters) no matter how large the input, and change a single bit of a gigabyte file and the whole digest changes unpredictably (the "avalanche" effect). That fixed length is why the comparison is trivial. You match 64 characters, not a whole file. Software publishers post checksums next to downloads precisely so you can verify that what you received is what they published, no corruption in transit, no swapped file. Paste the expected value and the tool compares it case-insensitively and flags a match or mismatch.
SHA-1 is included because older sites still publish SHA-1 sums, but it is deprecated for security use, collisions are practical since 2017. For integrity verification against a trusted published value it still detects accidental corruption; for anything adversarial, use the SHA-256 value when offered. MD5 is omitted: Web Crypto deliberately excludes it.
Frequently asked questions
What does comparing hashes actually prove?
That your copy of the file is bit-for-bit identical to the one whose hash the publisher posted. Any corruption in download, disk error or tampering produces a completely different hash. It does not prove the software is safe, only that it is unmodified.
Which algorithm should I use?
Whichever the publisher posted, SHA-256 is today's standard. If both are offered, prefer SHA-256 over SHA-1; SHA-1's collision resistance is broken (demonstrated practically in 2017), though it still catches accidental corruption.
Why do the same file's hashes differ between my machine and the site?
Either the download is corrupted/incomplete, the site posted the hash of a different version, or one side hashed a different file (e.g. the installer vs the archive). Re-download and check the version label first, that explains most mismatches.
Is there a size limit?
The file must fit in browser memory, so multi-gigabyte files depend on your device; hundreds of megabytes are routinely fine. Hashing happens locally either way.
What are SHA-256, SHA-512 and SHA-1?
All are cryptographic hash functions that turn any input into a fixed-length fingerprint: SHA-256 outputs 256 bits (64 hex chars), SHA-512 outputs 512 bits (128 hex chars), and the older SHA-1 outputs 160 bits (40 hex chars). SHA-256 and SHA-512 are both from the SHA-2 family and considered secure; pick whichever the publisher listed so your hash matches theirs.
Do uppercase and lowercase hashes matter when comparing?
No, a hash is a hexadecimal number, so "A3FF" and "a3ff" are identical. Publishers print it in either case; this tool compares case-insensitively, so a match is a match regardless of how the expected value was formatted. Only the characters and their order matter.
Why no MD5?
The Web Crypto API excludes MD5 deliberately, its collision resistance has been broken for two decades. Any site still publishing only MD5 sums is overdue an update; SHA-256 is the drop-in replacement.