What checksums are for — download integrity, on your own device
When a project publishes a file — an installer, an OS image, a firmware blob — it often publishes a checksum next to it: a short hexadecimal fingerprint computed from every byte of the file. After downloading, you compute the same checksum on your copy. If the values match, your copy is byte-for-byte identical to what the publisher released. If they differ, something changed along the way: an interrupted transfer, a flaky disk or proxy, a stale mirror — or, in the worst case, a file someone deliberately tampered with.
Most online checksum tools ask you to upload the file to their server first, which is slow and a privacy problem — the very installer, backup or document you are checking ends up on someone else's machine. This tool takes the opposite approach: it hashes the file on your own device using the browser's built-in Web Crypto API (for the SHA family) and small in-page implementations of MD5 and CRC32. Nothing is transmitted, nothing is stored, and it keeps working if you go offline after the page loads.
CRC32 vs MD5 vs SHA-1 vs SHA-256 vs SHA-512
| Algorithm | Output bits | Hex length | Security status | Typical use |
|---|---|---|---|---|
| CRC32 | 32 | 8 | Not cryptographic — error detection only | ZIP/PNG internals, network frames, quick corruption checks |
| MD5 | 128 | 32 | Broken (practical collisions since 2004) | Legacy download checksums, deduplication, cache keys |
| SHA-1 | 160 | 40 | Broken (public collision in 2017) — deprecated | Older signatures, legacy Git object IDs |
| SHA-256 | 256 | 64 | Secure — current standard | Verifying downloads, signatures, certificates |
| SHA-512 | 512 | 128 | Secure | Same as SHA-256; often faster on 64-bit CPUs |
Need to hash text instead of a file? Use the hash generator for SHA values or the MD5 generator for legacy MD5 strings.
Where sites publish checksums
Look for them right next to the download link: a line like SHA256: b94d27b9…, a SHASUMS256.txt or .sha256 file alongside the release, a "verify your download" page (common for Linux ISOs), or the asset list of a GitHub release. Package managers do this automatically — apt, npm, pip and friends verify every package against a recorded hash before installing. If a site only publishes MD5 or SHA-1, the check still catches corruption; it just can't rule out deliberate tampering.
Do the same in a terminal
Every desktop OS ships a checksum command. The browser tool and these one-liners produce identical values for the same file:
- Windows:
certutil -hashfile installer.exe SHA256(also acceptsMD5,SHA1,SHA512) - macOS:
shasum -a 256 installer.dmg(ormd5 installer.dmg) - Linux:
sha256sum installer.iso(orsha256sum -c SHASUMS256.txtto check a whole list)
Frequently asked questions
- What is a checksum?
- A checksum is a short, fixed-length fingerprint computed from every byte of a file. Run the same file through the same algorithm anywhere and you get the same value; change even a single bit and the result is completely different. That makes checksums a fast way to confirm a file is exactly what its publisher released — neither corrupted in transit nor altered by someone else.
- How do I verify a downloaded file?
- Copy the checksum published on the download page (usually a SHA-256 value next to the file link), drop the downloaded file into this tool, and paste the published value into the verify box. The algorithm is detected automatically from the length of the value, and you get a clear match or no-match result. A match means your copy is byte-for-byte identical to the original.
- Is my file uploaded to a server?
- No. The file is read and hashed entirely on your own device using your browser's built-in Web Crypto API, plus small in-page implementations of MD5 and CRC32. Nothing is transmitted or stored — you can load the page, disconnect from the internet and keep verifying files offline.
- Which algorithm should I use?
- Use SHA-256 whenever you have a choice — it is the modern standard, collision-resistant, and what most projects publish today. MD5 and SHA-1 are fine for spotting accidental corruption, but both are cryptographically broken, so they cannot prove a file was not deliberately tampered with. CRC32 is only an error-detection code, not a security measure.
- What if the checksum doesn't match?
- First rule out simple causes: make sure you compared against the value for the exact file name and version you downloaded, and that the download finished completely. Then download the file again — most mismatches are interrupted or corrupted transfers. If a fresh download from the official source still does not match the published checksum, do not open or install the file, and report it to the publisher.
- What is the difference between MD5, SHA-1 and SHA-256?
- They differ in output size and security. MD5 produces 128 bits and SHA-1 produces 160 bits; both have practical collision attacks, meaning attackers can craft two different files with the same hash, so neither should be trusted for security decisions. SHA-256 and SHA-512 belong to the SHA-2 family, produce 256 and 512 bits, and have no known practical attacks — which is why SHA-256 is the default for verifying downloads today.