File Checksum & Verify

About checking a file's checksum

A download page lists a long string of letters and numbers next to the file. It is there so you can prove that what arrived on your disk is what the publisher put up: not truncated, not corrupted, not swapped for something else.

On Windows the command is certutil -hashfile thefile SHA256. Then you have to compare a 64-character string to another 64-character string by eye, which is exactly the kind of task people get wrong.

Drop the file in. The three checksums appear. Paste the one you were given and the page tells you yes or no.

How to use it

• Click Click to choose or drop your file on the page
• Wait while it reads — a big ISO takes a moment, and the progress is shown
• Paste the checksum from the download page into the box
• Read the answer: a green Match or a red Does not match

You do not have to know which algorithm it is

This is the part that makes it quick. Download pages very often print a checksum without saying what kind it is.

They do not have to, because the length gives it away: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256. So all three are worked out in the same pass, the box takes any of them, and the page works out which one you pasted and compares against that. Nothing to select.

You can paste the whole line, too. SHA256: 9f86d081… ubuntu.iso works — the checksum is picked out of it.

Any size of file

The file is read in slices and the hashes are built up as it goes, so memory stays flat. A 5 GB disk image works the same way a 5 KB text file does.

That is also why the reading takes a little while on a large file: every byte has to be read off your disk. Nothing is being uploaded — the progress bar is your own drive.

What a match tells you, and what it does not

A match means the file on your disk is byte-for-byte the file the checksum was made from. The download completed, nothing was corrupted in transit, nothing was altered on the way.

A match does not mean the file is safe. If an attacker can change the file, they can usually change the checksum printed next to it. A checksum proves the file matches the page; it does not prove the page is honest. For that you need a signature, not a hash.

MD5 and SHA-1 are not secure any more — it is possible to build two different files with the same MD5. They are still perfectly good for catching a damaged download, which is what most checksums are published for, so they are shown. When a page offers SHA-256, use that one.

What people use it for

• Checking a Linux ISO or Windows image before installing from it
• Confirming a large download finished properly over a shaky connection
• Verifying an installer is the one the vendor published
• Checking a file copied to a USB stick or NAS arrived intact
• Confirming a backup or archive is identical to the original
• Proving two files are the same without opening either

Good to know

• Nothing is uploaded. The file is read on your device and never leaves it
• The file is only read, never modified
• MD5, SHA-1 and SHA-256 are all produced in a single pass over the file
• SHA-384 and SHA-512 are not offered: they need 64-bit arithmetic that is slow in a browser on a multi-gigabyte file, and download pages almost never publish them. For text, Hash Generator has all five
• Upper and lower case do not matter when you paste — the comparison ignores it
• Works in every browser, and on a phone for smaller files

Related tools

• Hash Generator — the same hashes for text you type or paste
• Duplicate File Finder — find identical files by their contents
• Compare Two Folders — verify a whole folder rather than one file
• Split and Join Large Files — check a file after rejoining its parts
• Zip and Unzip Files — unpack what you just verified