Checksum Verifier
Paste the checksums a download page publishes, choose the files you downloaded, and see at once which ones match. Nothing is uploaded.
Lines such as “hash file-name”, as sha256sum and shasum write them, or “SHA256 (file-name) = hash”. The kind of hash comes from its label or its length.
Drop the downloaded files here, or
Up to 50 files, 25 MB each. They’re hashed on your device; nothing is uploaded.
Everything happens on this page, on your device: your files and checksums are never uploaded or saved.
Make sure every download arrived whole
Software, disk images and data sets often come with a list of checksums: one long hash per file. If your copy gives the same hash, it’s byte for byte the file that was published; change a single byte and the hash comes out completely different. This page checks a whole batch at once, so you don’t compare long strings of digits by eye.
How to use it
- Copy the checksums from the download page and paste them in, or open the checksum file itself.
- Choose the files you downloaded, or drop them on the box: up to 50, each up to 25 MB.
- Read the result beside each file. Change the list or add files, and it checks again by itself.
What it reads
- sha256sum, md5sum and shasum lists: the hash, two spaces (or a space and a *), then the name.
- BSD style: SHA256 (name) = hash, as BSD systems and OpenSSL write it.
- A single hash: every chosen file is compared with it.
- Kinds: MD5, SHA-1, SHA-256, SHA-384 and SHA-512, told apart by their labels or lengths. Capital letters in a hash make no difference.
- Names with folders, such as dist/app.zip, go with the chosen file of the same name.
What the results mean
- Matches: the file is the one listed.
- Doesn’t match: it differs. Download it again before you use it.
- Not in the list: no line has its name. If its hash matches another line, the page says so: the same file, renamed.
- Listed but not chosen: a file in the list you haven’t chosen yet.
Good to know
- MD5 and SHA-1 aren’t for security. They still catch a damaged download, but files with the same one can be made on purpose. Prefer SHA-256 where a site offers it.
- Signatures aren’t checked. A signed list is read, but whether it’s genuine is for your own tools to say.
- Paste the whole page section if you like. Lines the page can’t read are listed under the box, and the rest still work.
- Hashes are worked out once. Paste a different list and only the kinds still missing are worked out.
- One file, or one bigger than 25 MB? The Hash Generator works out the hashes of one text or file of up to 200 MB and compares a single published checksum; this page checks many files against a whole list.