File Hash Checker
Get the SHA-256, SHA-1, SHA-512, or MD5 digest of any local file and check it against the checksum a publisher gave you. Hashing runs in your browser — the file never leaves your device.
No file selected.
Comparison ignores letter case and surrounding whitespace.
How to use
- Select a local file with the file picker. Nothing is uploaded.
- Choose an algorithm. SHA-256 is the default and the right choice for most checksums; pick SHA-1 or MD5 only when the published checksum uses them.
- Press Compute hash. Large files show a progress bar; you can pick another file at any time.
- Copy the digest, or paste the expected checksum and press Compare to see Match or Mismatch.
What the result means
A hash (checksum, digest) is a fixed-length fingerprint of the file's bytes. Changing a single byte produces a completely different digest, so comparing your file's hash with the one a publisher lists tells you whether the download is intact and unmodified.
- SHA-256 — 64 hex characters. The modern default for software downloads and integrity checks.
- SHA-512 — 128 hex characters. Same family as SHA-256, longer output.
- SHA-1 — 40 hex characters. Deprecated for security; collisions have been demonstrated. Kept for compatibility with older checksums.
- MD5 — 32 hex characters. Broken for security; still common in legacy checksum files. Compatibility use only.
Limits and requirements
- One file at a time, up to 100 MiB. The file is read fully into memory in your browser before hashing.
- SHA-256, SHA-1, and SHA-512 use the browser's built-in Web Crypto API, which is available on HTTPS pages (and on localhost) in current Chrome, Edge, Firefox, and Safari. MD5 is computed by a small local implementation on this page because browsers do not provide it.
- No HMAC, batch hashing, text hashing, malware lookups, or server-side storage — this page does one thing: hash a local file and compare the digest.
Frequently asked questions
How do I get the SHA-256 of a file?
Choose the file, leave SHA-256 selected, and press Compute hash. The 64-character hexadecimal digest appears below with a Copy button. The whole computation happens locally in your browser.
Which algorithm should I use?
Match whatever the publisher provides. If you have a choice, use SHA-256 (or SHA-512). SHA-1 and MD5 are legacy algorithms with known collision attacks — they can still confirm an accidental corruption, but they cannot protect you against a deliberately tampered file.
How does the comparison work?
Paste the expected checksum and press Compare. The tool trims whitespace, ignores letter case, checks that the value has the right length for the selected algorithm, and then does an exact comparison. The result is shown as Match or Mismatch together with both digests.
Does a matching hash mean the file is safe?
No. A match means your file is identical to the one that produced the published digest. If the publisher's page or the checksum itself was compromised, a matching hash proves nothing about safety. Obtain checksums from a source you trust.
Why does the digest differ from what I expected?
Usually one of: a different algorithm (an MD5 value will never match a SHA-256 digest), an incomplete or modified download, or comparing against the checksum of a different release. Re-download the file and double-check which algorithm the publisher used.
Is there a file size limit?
Yes, 100 MiB per file in this version, because the file is held in browser memory while hashing. Larger files are refused with a clear message.
Is my file uploaded to a server?
No. The file is read and hashed entirely in your browser; this page loads no third-party scripts and sends nothing anywhere. You can confirm this in your browser's network panel.