Free Online File Checksum Calculator
Runs in this tab. A token, a key, a config — whatever you paste stays local.
Loading the tool…
How it works
Streamed in chunks, so size is not the limit
The file is read with the File API and fed to the hasher in chunks rather than loaded into memory in one piece, so a multi-gigabyte ISO hashes without the tab running out of memory. The digest is identical to what sha256sum, shasum -a 256 or Get-FileHash produce on the same file — a hash is defined over bytes, so the tool that computed it is irrelevant.
- SHA-256
- The default and what almost every project publishes. 64 hex characters.
- SHA-384 / SHA-512
- Also available when a release publishes the longer digests.
- MD5 / SHA-1
- Offered for legacy checksums only. Both have practical collision attacks and prove nothing against a deliberate tamper.
- Chunked read
- The file is sliced and hashed incrementally, so memory use stays flat regardless of file size.
- Comparison
- Paste the expected digest and it is compared for you, case-insensitively — hex digests are the same value in either case.
How to use it
How to verify a file checksum online
- 01
Choose the file
Drag it in or pick it. It is read from disk, not uploaded.
- 02
Pick the algorithm
Match whatever the project published, usually SHA-256.
- 03
Paste the published digest
The comparison is exact — one differing character means a different file.
Where it earns its keep
Where a checksum matters
- Verifying a Linux ISO or an installer before running it.
- Confirming a large transfer over a flaky connection arrived intact.
- Checking a build artefact matches the digest in a release manifest.
- Comparing two copies of a file without diffing them byte by byte.
Questions
File Checksum, answered
Is my file uploaded to be checked?
No. The file is read from disk by this browser tab and hashed locally — nothing is transmitted. That is what lets you checksum a database dump or a signed archive you would not upload to a third party.
Does a matching checksum prove the file is safe?
No. It proves the bytes match the digest you were given. If an attacker controlled the page that published the digest, both can be theirs. A checksum verifies integrity; a signature you check against a known key verifies origin.
Should I trust an MD5 checksum?
Only against accidental corruption. MD5 and SHA-1 collisions are cheap to produce, so a matching legacy digest says the download did not get mangled, not that nobody altered it deliberately.
How large a file can it handle?
Multi-gigabyte files are fine because the read is chunked and memory use stays flat. The practical limit is time and the browser's own file handling, not the size of the tab's heap.