Skip to content
StoutNook
Menu
Every tool runs in your browser. Your files never leave your device.

File checksum calculator

Drop a file to calculate its SHA-256, SHA-512, SHA-1 and MD5 checksums, then paste the checksum from the download page to compare. Large files are read in chunks on your device, and nothing is uploaded.

Checksum of

The algorithm is worked out from its length. Formats like “sha256:…” or “SHA256 (file) = …” work too.

Algorithms

Algorithms to calculate

All selected checksums are calculated in a single read of the file.

Checksums

Add a file to see its checksums.

  • SHA-256
    —
  • SHA-512
    —
  • SHA-1not for security
    —
  • MD5not for security
    —

SHA-1 and MD5 are broken for security: people can make two different files with the same checksum on purpose. They’re still fine for spotting accidental damage, such as a corrupted download.

  • Nothing is uploaded
  • Free, no sign-up
  • Works on phone and desktop

How to verify a file’s checksum

  1. 1

    Drop the file into the box, or click it to choose one. Big files are fine: they’re read in pieces on your device.

  2. 2

    Copy the checksum from the official download page and paste it into Expected checksum. You can do this first, too.

  3. 3

    Read the result: Match means your copy is identical to the original; No match means it isn’t.

  4. 4

    Need the checksum itself? Click Copy next to the algorithm you want. Switch on Upper case first if you need capitals.

Features

  • All the common algorithms

    SHA-256, SHA-512, SHA-1 and MD5, plus SHA-384, SHA3-256 and BLAKE3, all from a single read of the file.

  • Handles huge files

    Files are read 4 MB at a time, so multi-gigabyte disk images work without filling your memory. Cancel any time.

  • Compares for you

    Paste the published checksum in almost any format. The algorithm is worked out from its length and the match is shown clearly.

  • Never uploaded

    Everything runs in your browser. The file, its name and its checksums stay on your device.

What a checksum proves, and what it doesn't

A checksum proves integrity: that your file is bit-for-bit the same as the file the checksum was calculated from. If a download was cut short, damaged on a failing disk or swapped somewhere along the way, the checksum changes completely, even if only one byte is different. That makes it the standard way to check a disk image, installer or backup before you rely on it.

What it can't prove is that the publisher, or the file, is trustworthy. A matching checksum only tells you that you got whatever the checksum describes. If an attacker breaks into a download site and replaces both the file and the checksum shown next to it, they will still match. Proving who made a file is the job of a digital signature: a GPG signature on the checksum list, or a code-signing certificate on Windows and macOS apps. For important downloads, check the signature too, or get the checksum from a second source such as the project's official announcement.

Where to find the published checksum

Look on the official download page, often in small print next to the download button, under "Verify your download" or in a release notes page. Many projects, including most Linux distributions, publish a text file named something like SHA256SUMS that lists the checksum of every file on the server, often with a signed copy beside it. Copy the line for your file, or just the long string of letters and numbers, and paste it into the Expected checksum box. Labeled formats such as sha256:… and SHA256 (file.iso) = … are recognized, as are the "checksum, then file name" lines that sha256sum prints, and the algorithm is detected from the length: 32 characters for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512.

The same check on Windows, Mac and Linux

Every major system can calculate checksums without installing anything. Replace file.iso with your file's name:

SystemCommand
Windows, Command Promptcertutil -hashfile file.iso SHA256
Windows, PowerShellGet-FileHash file.iso (SHA-256 unless you add -Algorithm MD5 or another)
macOS, Terminalshasum -a 256 file.iso
Linuxsha256sum file.iso, or sha256sum -c SHA256SUMS to check a whole list

Use SHA512, MD5 or SHA1 in place of SHA256 with certutil, and -a 512 or -a 1 with shasum. You can paste the output of any of these commands straight into the Expected checksum box.

Why MD5 and SHA-1 are only for accidental damage

A secure hash must make it practically impossible to find two different files with the same checksum (a collision). MD5 lost that property in 2004, and collisions are now cheap to make. SHA-1 followed: researchers from Google and CWI Amsterdam published the first real SHA-1 collision in 2017. NIST, the US standards body, now says SHA-1 should be phased out by December 31, 2030 in favor of the SHA-2 and SHA-3 families, which this page also calculates (SHA-256, SHA-384, SHA-512 and SHA3-256).

In practice, an MD5 or SHA-1 match still reliably shows a download wasn't corrupted, because accidental damage never produces a collision. The risk is deliberate: someone who prepares two files in advance can make a harmless one and a malicious one share an MD5. So when a publisher offers SHA-256 or SHA-512, compare that one, and treat MD5 and SHA-1 as a check for broken downloads only.

Sending a file to someone and want to keep it private as well? Encrypt the file with a password first and send them its SHA-256 so they can check it arrived intact. Not sure about the link you're downloading from? Paste it into the link safety checker before you click.

Frequently asked questions

What is a file checksum?

A checksum (or hash) is a short fingerprint calculated from every byte of a file, such as a 64-character SHA-256 value. Change a single bit and the checksum changes completely. Publishers list it next to downloads so you can confirm your copy is exactly theirs.

How do I check a SHA-256 checksum on Windows, Mac or Linux?

On Windows, open Command Prompt and run certutil -hashfile file.iso SHA256, or in PowerShell run Get-FileHash file.iso. On a Mac, open Terminal and run shasum -a 256 file.iso. On Linux, run sha256sum file.iso. Or drop the file on this page, which gives the same result.

Is MD5 or SHA-1 good enough?

For spotting a corrupted or incomplete download, yes. For security, no: it's practical to create two different files with the same MD5, and it has been done for SHA-1, so NIST says SHA-1 should be phased out by the end of 2030. If a publisher lists SHA-256 or SHA-512, compare that one.

What does it mean if the checksum doesn't match?

Your file isn't identical to the one the checksum was made from. Usually the download was cut short, or you're comparing the wrong file, version or algorithm. Download it again from the official site. If it still doesn't match, don't open or install it.

Does a matching checksum mean the file is safe?

It means the file is exactly the one the checksum describes, nothing more. If the publisher is trustworthy and the checksum came from them, you have their genuine file. A checksum says nothing about whether the file itself is harmless, and if an attacker controls the website, they can change the file and the checksum together.

Is my file uploaded?

No. The file is read by your browser and hashed on your device, so it never leaves your computer and works even for private files. The file name, the checksums and anything you paste aren't saved or put in the page address.

Why does my text give a different checksum in another tool?

Checksums depend on the exact bytes. A trailing space or line break, Windows (CRLF) versus Unix (LF) line endings, or a different text encoding all change the result. This page hashes text as UTF-8 with LF line breaks, exactly as typed.

More free tools