File Checksum Calculator is a free tool that calculates the SHA-256, SHA-512, SHA-384 and SHA-1 checksums of any file. The file is read and processed inside your browser and is never uploaded, so it is safe to use with private documents. It keeps working without an internet connection once the page has loaded and you have checked one file.
How to check that a download is genuine
- Find the checksum on the website you downloaded from. It is usually labelled "SHA-256", "checksum" or "hash".
- Drop the downloaded file into the box above, or tap Choose file.
- Paste the checksum from the website into the box below the results.
- A green Match means the file is exactly what the publisher released.
What is a checksum?
A checksum (also called a hash) is a short string of letters and numbers calculated from every byte of a file. The same file always gives the same checksum, but changing even a single byte produces a completely different one. That makes it a reliable way to confirm a file was not damaged during download or swapped for a different one.
Which algorithm should I use?
- SHA-256 is the most widely used today. Use it when you have a choice.
- SHA-512 and SHA-384 are longer versions from the same family, used by some Linux distributions and developer tools.
- SHA-1 is included only so you can check older downloads. It can be deliberately faked, so do not rely on it for security.
You don't need to pick one: the tool calculates all four at once, and recognises which one you pasted from its length.
Limitations
The whole file is loaded into your device's memory, so files of several gigabytes may be slow, or fail on phones. MD5 checksums are not supported yet. Checksums prove that a file is unchanged, not that the original was safe, so only trust checksums published by the official source.
To hash a piece of text rather than a file, including with MD5, use theHash Generator. To check that a message or webhook really came from who it claims, you need a keyed signature from the HMAC Generator.
Frequently asked questions
Is my file uploaded?
No. The file is read directly from your device into your browser, and the checksum is calculated there. Nothing is sent to a server, so it works even for private or very large files.
What is a checksum used for?
A checksum is a short fingerprint of a file. If even one byte changes, the checksum changes completely. Software publishers list checksums so you can confirm a download is complete and has not been tampered with.
Which algorithm should I use?
Use whichever one the publisher lists, most often SHA-256. SHA-1 is included only for checking older downloads; it is no longer considered secure against deliberate tampering.
Is there a file size limit?
There is no fixed limit, but the whole file is read into memory, so very large files (several gigabytes) may be slow or fail on phones and older computers.
Last updated