Why verify a file’s checksum?
When you download software, an operating system image or an important update, many official sites publish a checksum next to the download link, usually SHA-256. Comparing the checksum of your file with the published one confirms two things: the download completed without corruption, and the file was not swapped for a modified copy from an untrusted mirror.
How to use the tool
- Drop the file onto the box or click to pick it.
- SHA-256, SHA-512, SHA-384, SHA-1 and MD5 are computed in seconds.
- Copy the checksum from the official site and paste it into “Expected checksum”.
- You get a green match or a red warning.
What if the checksums don’t match?
- Make sure you compared the right algorithm and the same version (checksums differ between releases).
- Download the file again directly from the official website, not from a link in a message or forum.
- If it still differs, don’t open or install it — it may have been tampered with.
Where do I find the official checksum?
Usually on the download page, labelled SHA256SUMS, Checksum or Hash. Take it from the official site over HTTPS: if you take it from the same suspicious mirror, it may be forged too. Some projects also sign their checksum file with a GPG key for extra assurance.
Privacy and performance
The file is read inside your browser and never uploaded, so you can check confidential documents safely. Files up to about 1.5 GB are supported depending on your device’s memory; the legacy MD5 is skipped above 400 MB. To hash text instead of a file, use the hash generator.