Checksum Calculator

Check that a downloaded file is the one published.

FREE - NO SIGN-UP - RUNS ON YOUR DEVICE

The file is read on this device

  • 4algorithms
  • 1file at a time
  • 0uploads
  • Freeno sign-up
In practice

What you can count on

  • 4algorithms
    • Four algorithms, MD5 through SHA-512
    • Match whichever the publisher printed
  • 0uploads
    • The file is read on this device
    • Nothing is sent to be checked
  • 1thing it proves
    • The bytes match the ones hashed
    • Not who published them
Specification

Checksum Calculator at a glance

Input
One file and an algorithm
Output
A hex digest to compare
Algorithms
MD5, SHA-1, SHA-256, SHA-512
Method
crypto.subtle, plus local MD5
What a match proves
The bytes match, nothing more
Text or file
Text or file, not both
Price
Free
Account needed
None
Where processing happens
On your device
How to

How to use Checksum Calculator

  1. 1

    Choose the file

    Pick the downloaded file. It is read inside this tab, at whatever size it is, and never sent for checking.

  2. 2

    Match the algorithm

    Use the same one the publisher used. A SHA-256 checksum will never agree with an MD5 digest of the same file.

  3. 3

    Compare end to end

    Set the result beside the published string and read every character. One difference means the file is not the same file.

Questions

Frequently asked questions

What does a matching checksum actually prove?

That the file holds the same bytes that produced the published digest. It says nothing about who wrote the file, so the checksum needs to come from a source you already trust.

The digests differ. What now?

Download the file again. A single wrong character means the bytes differ, which is usually an interrupted download, and occasionally a file that is not the one you meant to get.

Which algorithm should I choose?

The one printed beside the download. MD5, SHA-1, SHA-256 and SHA-512 all produce different digests for the same file, so they cannot be compared across.

Is the file uploaded to be checked?

No. It is read inside this browser tab and the digest is worked out there. Nothing leaves the device and nothing is stored.

Background

Before you trust a match

Choose the file, pick the algorithm the publisher used, and read the digest. You compare it by eye against the published string; nothing about the file is sent away.

  • Take the published checksum from a different place than the download itself where you can, such as signed release notes.
  • A checksum finds a damaged download quickly, which is the job it does best.
  • MD5 and SHA-1 still appear beside downloads; they catch damage, and cannot rule out a file built to collide on purpose.
  • Text and files hash differently, so paste text only when the checksum was made from text.

Full specification

Specification of the Checksum Calculator tool
InputOne file chosen from this device, or pasted text, and the algorithm the publisher used.
OutputThe hexadecimal digest, ready to set beside the published string.
AlgorithmsMD5, SHA-1, SHA-256 and SHA-512. Pick the one that matches the checksum you were given.
Methodcrypto.subtle handles the SHA family; MD5 is local JavaScript kept for checksums.
What a match provesThat the bytes are the ones that were hashed. Not that the publisher is genuine, or that the checksum page is.
Text or fileThe two inputs are exclusive: choosing a file clears the text box, and typing clears the chosen file. One digest at a time.
PriceFree. Supported by clearly labeled ads outside the working area.
Account neededNo.
Where processing happensIn your browser tab. Your input is never uploaded.
Next step

Keep going with the same files

All developer tools: Developer tools on SPOTTOOLS