Compute SHA-256, SHA-512, SHA-1 and CRC32 for any file and compare against an expected checksum. The file is hashed on your device, never uploaded.
First time here? Drop the file into the tool Your input is processed locally and disappears when you close the tab.
Downloading an installer from a mirror, or a large archive over a flaky connection, raises a question worth answering: is this the file the publisher actually shipped? A checksum verifier answers it in seconds.\n\nDrop a file in and this tool computes SHA-256, SHA-384, SHA-512, SHA-1 and CRC32 simultaneously, then compares any checksum you paste against all of them and highlights the one that matches. You do not need to know in advance which algorithm the publisher used, and comparison ignores case and stray whitespace because checksums get copied from terminals, web pages and emails in wildly inconsistent formats.\n\nWhen it does not match, the tool explains rather than just failing. The most common cause is an incomplete paste, so it tells you the expected lengths — 64 hex characters for SHA-256, 40 for SHA-1, 32 for MD5. If the length is right and it still fails, the file genuinely differs from the published one.\n\nWorth being precise about what this proves: a match confirms your copy is byte-identical to the one that was hashed. It says nothing about whether the publisher is trustworthy, and it proves nothing if the checksum came from the same page as a tampered download — an attacker who can replace one can replace the other. Hashing happens on your device via the Web Crypto API, so nothing is uploaded.
Drop the file into the tool
Wait for the digests to compute
Paste the checksum the publisher provided
Check the match verdict
Drop a file to checksum
Hashed on your device — the file is never uploaded
What a checksum proves and what it does not. Matching confirms the file you downloaded is byte-identical to the one the publisher hashed. It does not prove the publisher is trustworthy, and it proves nothing at all if you took the checksum from the same page as a compromised download.
SHA-1 and CRC32 are included because plenty of projects still publish them. Neither is collision-resistant — use SHA-256 or better when you have the choice.