Which hash should I use?

SHA-256 is the modern default — strong, fast, universally supported. MD5 and SHA-1 are broken cryptographically but still fine for integrity-only checks (where a malicious attacker isn't involved). Use what the publisher posted.

Why does verification take so long for big files?

Hashing a 4 GB ISO requires reading every byte. Modern browsers do this at 100–500 MB/s depending on hardware, so several seconds. Progress is shown so you know it's working.

Will it work offline?

Yes — the hash computation runs entirely in your browser. Once the page loads, you can disconnect and still verify files.

No — read locally via the File API. Even multi-gigabyte files never leave your machine.

md5 · sha-1/256/384/512 · local · web crypto

Verify file checksums against a published hash

Drop in a file, pick MD5 or any SHA flavour, paste the expected hash, and confirm integrity. Hashing runs entirely in your browser via Web Crypto.

Checksum Verifier

Algorithm

SHA-256

selected

File

—

no file

Status

idle

live

Output

—

0 B

input · file + expected

Expected hash

Web Crypto handles SHA flavours natively. MD5 is loaded lazily because browsers no longer ship it.

output · sha-256

Upload a file to hash.

Quick Start

How to verify a checksum

Hashes act like fingerprints. If the value you compute matches the value the publisher posted, the file is intact.

01
Choose your file
Pick the download from disk. Everything stays local.
Inputs are treated as UTF-8 throughout the pipeline and validated client-side as you type — nothing dispatches until the value is well-formed.
fileinpututf-8client-sidevalidated
input · textfile · set
```
installer.dmg · 124MB
```
loaded · parsedclient-side
02
Pick the algorithm
Match whatever the publisher used — SHA-256 is the modern default.
Each toggle re-computes through a memoised hook, so flipping options never resets your input and the UI stays snappy on large inputs.
algooptionslivememoisedtoggles
algo · memoisedsha-256 · live
```
SHA-256 selected
```
options set · memoisedlive
03
Paste the expected hash
Whitespace, casing, and stray newlines are normalised for you.
Randomness — where used — comes from crypto.getRandomValues, never Math.random. Heavy work sits in useMemo.
comparecomputeinstantlocaldeterministic
expected · instanthex · computed
```
9f86d081884c7d65…
```
computed · instantinstant
04
Read the verdict
Green is a match. Red means the file is corrupted or tampered with.
Copy writes through navigator.clipboard and downloads use a Blob — zero network traffic. Same input plus same options always yield the same bytes.
verdictcopydownloadzero-networkreproducible
ok · copiedmatch · copied
```
MATCH
```
shipped · ready to shipsuccess

Pro tips

Pro tips for everyday utilities

Reach for crypto.getRandomValues

Cryptographically random for IDs, tokens, salts. Math.random is for animation and games, not security.

Sort IDs lexicographically

UUID v4 has no time ordering. Use ULID or UUID v7 if you need sorted IDs.

Mock data with seeds

Faker-style libraries can be seeded so tests are reproducible. Embed the seed in the fixture file.

Reference cards beat memory

Cheatsheets for Vim, Git, Docker, Linux signals are faster than man pages when you’re mid-flow.

Browser APIs vary

Touch events, gamepads, and clipboard differ across vendors. Feature-detect before use.

Persist in the right place

localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data.

Use Cases

When to verify a checksum

Downloads, releases, archives — anywhere integrity matters.

ISO downloads

Confirm a Linux ISO matches the upstream hash before flashing. Random values come from crypto.getRandomValues — cryptographically secure for tokens, salts, and session IDs. Math.random is deterministic enough for animations but predictable enough to be a security bug.

CSPRNG-backed

Release artefacts

Verify built binaries against the GitHub release SHA-256. Pair with hashids, ULID, or UUID v7 when you need both random and sortable — useful for primary keys, public-facing IDs, and event log ordering without a sequence column.

reproducible

Backup audits

Spot bit-rot by comparing old archives to recorded hashes. Output is deterministic given the same seed, so fixtures and tests stay reproducible across CI runs and contributor machines. Embed the seed in the fixture file for full replay.

snappy

Mirror integrity

Validate files pulled from third-party mirrors. Heavy work runs through useMemo so the UI stays snappy on large inputs. Same input + same options yields identical bytes — the kind of stability snapshot tests rely on.

feature-detected

Forensics

Document evidence with a chain-of-custody hash. Storage tools persist to the right backend: localStorage for user preferences, sessionStorage for transient state, IndexedDB for structured data. Pick the right shelf and quota worries disappear.

deterministic

Supply chain

Spot tampered installers before they hit a developer machine. Browser feature detection: clipboard, fullscreen, gamepad, and Web Bluetooth APIs gracefully fall back when unavailable. No surprise white screens on Safari or older Firefox.

production-ready

FAQ

Frequently asked questions

Which algorithm should I use?

Prefer SHA-256 when the publisher gives a choice. MD5 and SHA-1 are still useful for matching legacy checksums but should not be trusted for security claims.

Does file size matter?

Hashing is linear in file size and streams through ArrayBuffer. Multi-gigabyte files work but will pin the tab while hashing.

What if my hash uses base64?

Convert it to hex first with the Base64 to Hex converter. This tool expects lowercase hex.

Can I check multiple files?

One at a time — re-pick a new file and the verdict updates.

Is anything sent to a server?

No. Hashing runs locally in your browser via Web Crypto and a lazy MD5 polyfill.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!