File Checksum
Compute a file's SHA-256, SHA-512 and SHA-1, and check it against the checksum somebody published.
What it does
File Checksum uses the cryptography built into your browser (WebCrypto) — the same standard algorithms your bank's site uses — on a file or a piece of text that never leaves this page.
When you need it
Before sending something sensitive by email or chat, when a file you received must be checked, or when you want to know whether a password or a signature holds up.
Limits and caveats
A strong algorithm is only as safe as the password or certificate behind it, and some checks — whether a certificate was revoked, say — need the issuer's servers, which the page says where it matters. Nothing is stored or logged. Everything happens in your browser, so the file never leaves your device.
How to file checksum
- Drop the file.
- Paste the checksum you were given.
- It says match or no match.
Everything happens on this device: no file is uploaded and nothing leaves the browser.
Frequently asked questions
- What is this actually for?
- Two things. Proving a download was not corrupted, and proving it was not swapped for something else. A project publishes the SHA-256 of its installer; if yours differs, you did not get their file.
- Why paste the checksum instead of reading both?
- Because comparing two 64-character hex strings by eye is exactly the task people are worst at, and 'close enough' is the failure this is meant to prevent. The machine compares them and the answer is one word.
- Why is SHA-1 marked as unfit?
- Because it is broken for proving a file was not tampered with — two different files can be made to share a SHA-1. It is still here because checksums published years ago are SHA-1, and it remains fine for noticing a truncated download.
- Do my files get uploaded?
- No. This tool runs entirely in your browser, so the file never leaves your device.