How to verify a file checksum
- Drop the file you downloaded onto the box, or tap to choose it. It is read and hashed on your device, so even large ISO images are not uploaded.
- SHA-256, SHA-1, MD5, SHA-384, SHA-512 and CRC32 checksums are calculated at once.
- Copy the checksum from the software's download page and paste it into Compare. The tool tells you whether it matches and which algorithm it belongs to, so you do not need to know in advance.
Why verify downloads?
A checksum confirms that the file on your disk is bit-for-bit identical to the one the publisher released. It catches incomplete or corrupted downloads, which are common with large files over unreliable connections, and it can reveal a file that was tampered with on a mirror or by malware. Linux distributions, password managers, crypto wallets, firmware updates and many open-source projects publish SHA-256 checksums for exactly this reason.
For the check to protect against tampering, the checksum itself must come from a trustworthy place, such as the official HTTPS website, rather than the same mirror as the file. If a project also offers a GPG signature, that gives stronger assurance.
Hashing uses the Web Crypto API (with MD5 and CRC32 in JavaScript). Nothing is sent over the network.
FAQ
What if the checksum does not match?
Download the file again, ideally from the official site. If it still differs, do not open it and contact the publisher, as the file may be corrupted or modified.
Which checksum should I compare?
Whichever the publisher lists. Most now use SHA-256. The Compare box recognises the algorithm automatically.
How large a file can I check?
Files of several hundred megabytes work on most devices. Very large files of many gigabytes may exceed browser memory; use sha256sum or Get-FileHash for those.