File Checksum Calculator

Calculate the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 checksum of any file or folder and compare it with a published hash, all in your browser.

runs locally on your browser. Your data never leaves your device.

Drag & drop files or folders here

Any file type, up to 1.0 GB each. Hashed in your browser.

Works with MD5, SHA-1, SHA-256, SHA-384, and SHA-512, in upper or lower case. The algorithm is picked from the length. You can paste a whole line from a checksum file too.

Hashed entirely in your browser. Nothing is uploaded, and the files are never copied anywhere.

Common Use Cases

Check that a Linux ISO or Windows installer matches the SHA-256 on the vendor's download page before you flash it or run it
Confirm that a large backup or video copied to an external drive is identical to the original, without uploading it anywhere
Generate a SHA-256 for a release file to paste into your changelog so users can verify what they downloaded
Hash a whole folder of deliverables to find which file differs from the list of checksums a client sent

About File Checksum Calculator

File Checksum Calculator computes the fingerprint of any file and tells you whether it matches the one the publisher listed. Drop in an installer, a disk image, a firmware update, a backup, or a whole folder, and the tool calculates five checksums for each file: MD5, SHA-1, SHA-256, SHA-384, and SHA-512. Every one has its own copy button, so you can paste the value straight into a release note, a bug report, or a terminal.

The main reason to use a checksum is to verify a download. Software sites, Linux distributions, and package registries publish a hash next to each file. If the copy on your disk hashes to the same value, every byte is identical to what the publisher released, so the download was not cut short, corrupted by a flaky connection, or swapped for a different file along the way. Paste the published value into the Expected hash box and the comparison runs live as you type. A green Match or a red Mismatch appears at the top and on the file itself, and the matching row of the table is highlighted. The comparison ignores letter case, because some sites print hashes in capitals and others in lowercase.

You do not have to say which algorithm you are comparing. The tool looks at the length of what you pasted: 32 hexadecimal characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384, and 128 is SHA-512. It also understands the formats checksum files actually use, so you can paste a whole line from a sha256sum or md5sum file (the hash, two spaces, and the file name), a BSD style line such as SHA256 (setup.exe) = followed by the hash, a Docker style sha256: prefix, or a hash written in groups separated by spaces or colons.

Most online hash checkers make you upload the file, which is slow for a multi-gigabyte image and a bad idea for anything private. This tool never sends a byte anywhere. SHA-1 through SHA-512 are calculated by the Web Crypto API that is built into your browser, and because Web Crypto does not include MD5, a small MD5 implementation is bundled with the page and runs in your tab. Files are read from your disk, hashed one at a time, and released from memory when they are done. Each file can be up to 1 GB, and a progress indicator shows while a large file is being processed.

A word on which hash to trust. MD5 and SHA-1 are no longer safe against a deliberate attacker, because researchers can produce two different files with the same value. They are still perfectly good at catching accidental damage, which is why many sites still list them. If you are checking that a file was not tampered with, compare a SHA-256 or SHA-512 value, and take it from the publisher's own HTTPS page rather than from the same place you downloaded the file, since an attacker who can change the file can usually change a hash sitting beside it.

Frequently Asked Questions

Is my file uploaded anywhere to calculate the checksum?
No. The file is read from your disk by your browser, and the hashes are calculated inside the tab. SHA-1, SHA-256, SHA-384, and SHA-512 use the Web Crypto API that ships with Chrome, Edge, Firefox, and Safari, and MD5 uses a small piece of code bundled with this page. No request carrying your file, its name, or its hash is ever made. You can confirm it by watching the Network tab in your browser's developer tools while a file is being hashed.
How do I verify a download with this tool?
Download the file, then find the checksum the publisher lists, usually on the download page or in a file called SHA256SUMS. Drop the downloaded file into the box and paste the published value into Expected hash. If the file's hash is identical you see a green Match and the file is exactly what was published. A red Mismatch means the file differs, so delete it, download it again, and compare once more before you run or open it.
Which hash algorithm should I compare, MD5 or SHA-256?
Use SHA-256 or SHA-512 whenever the publisher offers one. MD5 and SHA-1 still detect a download that was corrupted or cut short, but collisions can be manufactured on purpose, so they cannot prove that a file was not swapped by an attacker. Where a site gives only an MD5 or SHA-1, a match is still useful as an integrity check. This tool shows all five, so whichever one the publisher printed is already on screen.
Why does my hash show a Mismatch when the file seems fine?
The most common causes are a download that stopped early, a copied hash that is missing its last characters, and hashing a different file than the one listed, such as a 32-bit build instead of a 64-bit one, or the wrong release number. Browsers and download managers can also leave a partial file behind. Check the length of what you pasted, confirm the version name, and try downloading the file again. Text files can also differ if line endings were converted on the way.
Does it compare uppercase and lowercase hashes the same way?
Yes. A hash is just a number written in hexadecimal, so ABCDEF and abcdef are the same value. The tool lowercases both sides before comparing, and it ignores spaces, colons, and the file name if you paste a full line from a checksum file. It rejects text that is not 32, 40, 64, 96, or 128 hexadecimal characters and explains what is wrong, such as a hash that was cut off.
Is there a limit on file size or number of files?
Each file can be up to 1 GB, because the browser has to read the whole file into memory to hash it and the hashing API does not accept a stream. Files are processed one after another and freed in between, so the size of the whole batch does not matter, only the largest file. Up to 300 files can be listed at once. A file that is too large or cannot be read gets its own error message while the others are still hashed.

Related Tools

View all File Tools

File Splitter

Split any large file into numbered parts by chunk size or part count, download them one by one or as a single ZIP, with a manifest for joining them again.

File Joiner

Join numbered .part001, .part002 chunks back into the original file. Parts are sorted by number and checked for gaps, so a missing part is named instead of producing a broken file.

Batch File Renamer

Rename many files at once with find and replace (text or regex), prefixes, suffixes, sequential numbering, and case changes, preview every new name, then download them as a ZIP.