File Checksum Verifier
Check whether a download matches the checksum the publisher printed — the file never leaves your machine.
The problem with every other checksum site
A 4 GB Linux ISO or a 300 MB installer cannot be uploaded to a hash website in any reasonable time, and if you did, you would be handing a file to a stranger. This page reads the file with the browser's own file API, streams it into the hash implementation in chunks, and displays the digest. The bytes are read from your disk and never transmitted.
How to check a published checksum
- Download both the file and the publisher's checksum list (often
SHA256SUMSorchecksums.txt). - Drop the file on this page and select the algorithm the publisher used.
- Paste the expected digest into the comparison field — the tool normalises case and strips whitespace.
- A match means the bytes are byte-for-byte identical. A mismatch means corruption or something worse.
The command-line equivalents
# Linux / macOS
sha256sum ubuntu-24.04.iso # print the digest
sha256sum -c SHA256SUMS # verify a whole manifest
# Windows PowerShell
get-file .\installer.exe | Get-FileHash -Algorithm SHA256
# macOS (no coreutils installed)
shasum -a 256 ubuntu-24.04.isoThe manifest and the file should come from two different paths where possible — if you fetched both from the same compromised mirror, the checksum proves nothing.
Why HTTPS alone is not enough
TLS protects the transfer, not the origin. If a mirror is compromised, or a maintainer's signing key leaks, you receive a perfectly valid TLS connection carrying a malicious file. A checksum published on a separate, independently-hosted page is a weak second factor; a GPG signature over the checksum file is a strong one.
Large-file behaviour
Files are processed in chunks, so a multi-gigabyte ISO works without exhausting memory, and a progress bar shows how far along the hash is. Truncated or interrupted reads are reported rather than silently producing a wrong digest.
How to use it
- Drop the downloaded file onto the drop zone.
- Choose the algorithm — SHA-256 unless the publisher says otherwise.
- Paste the expected digest, or just read the computed one.
- Act on the match or mismatch result.
Worth knowing
- Works on files of any size supported by your browser's storage.
- Hashes the raw bytes; line-ending conversion never occurs, unlike a text paste.
- Accepts hex digests in any case, with or without separators.
- SHA-256, SHA-1 and MD5 supported; SHA-512 for very large manifests.
Limitations
- A matching checksum proves the bytes match a published reference — not that the publisher is trustworthy.
- Files are read locally; extremely large files still take time proportional to their size.
- For directory trees, generate a recursive manifest instead.
- Some publishers sign the manifest with GPG — verify that separately for real assurance.