File Hash Calculator

Drop a file or pick one with the file picker — get all common hashes side-by-side. Paste the publisher's expected hash to instantly verify your download. Files never leave your browser.

How to verify a download

1. Find the publisher's expected hash. Open-source projects post it on the download page or in a SHASUMS / checksums.txt file.
2. Paste that expected hash into the "Compare to" field above.
3. Pick your downloaded file with the file picker.
4. If "✓ Match" appears, the file is intact. If not, your download is corrupt or tampered with.

The full walkthrough is SHA-256 checksum — how to verify a file download: where publishers post the hash, what a mismatch usually means, and how the compare works in the browser. Nothing is uploaded.

What hash should you compare against?

• SHA-256 is the modern default. Most projects publish SHA-256 alongside (or instead of) MD5/SHA-1.
• MD5 is still common for ISO files and old-school release archives. MD5 still works for accidental-corruption checks, but if both are published, prefer SHA-256.
• SHA-1 is deprecated. If a publisher only offers SHA-1, accept it for accidental-corruption verification but raise an eyebrow about their tooling.

What this catches

• Truncated / corrupted downloads — partial transfers, network errors.
• Wrong file — you saved the wrong link by mistake.
• Mirror tampering — if you got the file from a mirror but the hash from the original publisher, a tampered mirror is detectable.

What this does not catch

• Sophisticated supply-chain attacks where the attacker also controls the published hash.
• Tampering before the publisher signed it — happens upstream.
• The publisher itself being compromised.

For critical downloads (OS images, security tools), pair the hash check with a signature check (gpg --verify on the detached signature file). The signature is what binds the hash to the publisher's identity.

Related

• SHA-256 checksum — verify a download: copy the published hash, drop the file, compare.
• SHA-256 generator — hash text or a file with SHA-256 only.
• Which hash function should you use?

Need text instead? Hash text on the home page. Want the download how-to? How to verify a SHA-256 checksum.