File Checksum Verifier

How this works

The file is read in your browser and hashed with WebCrypto. It is never uploaded, which is the whole reason to do this in a page rather than through a service — sending a file somewhere to check its integrity means the file has now been somewhere. Paste the published checksum and the comparison happens locally too. What the result is careful about is the claim: a match proves the bytes are identical to whatever produced that checksum, which catches truncated and corrupted downloads reliably. It does not prove the file is genuine, because whoever published the checksum is usually whoever published the file.

What the results mean

Digest

The computed hash. Compare it against the value published beside the download.

Matches

The bytes are identical to what produced the published checksum. Integrity confirmed.

Does not match

Usually a truncated download or a checksum from a different version or build variant.

Proves authenticity

No. That needs a signature checked against an independently obtained key.

Common problems and fixes

The checksum does not match

Re-download first — truncation is the most common cause by far. Then check the checksum is for your exact version, architecture and installer type, which all change it.

Which algorithm should I use?

Whichever the publisher used. SHA-256 is the modern default; SHA-1 appears on older releases and is included only for comparing against those.

The page freezes on a large file

The file is read into memory to hash it. Very large files can exhaust the tab, which is a limitation of doing this without a server.

Frequently asked questions

More in Security

• Hash GeneratorGenerate SHA-1, SHA-256, SHA-384 or SHA-512 hashes of text, in your browser.
• HMAC GeneratorCompute an HMAC, and see why it is not a hash of the key and the message.