Checksum Calculator
Compute MD5, SHA-1, SHA-256, and SHA-512 file hashes — and verify downloads against expected checksums. All computed locally in your browser.
Files are hashed locally with SubtleCrypto and spark-md5 in your browser — nothing is uploaded. Large files are read in 4 MB chunks to keep the UI responsive.
Four algorithms, one read
MD5, SHA-1, SHA-256, and SHA-512 computed together — your file is streamed in 4 MB chunks for huge inputs.
Verify downloads instantly
Paste an expected checksum and the tool tells you which algorithm matched — or warns you if nothing does.
100% local
Uses SubtleCrypto and spark-md5 in your browser. Files are never uploaded, even when multi-gigabyte.
What is a file checksum?
A checksum is a short, fixed-length fingerprint of a file's exact byte contents. The same bytes always produce the same checksum, and a single-bit change anywhere in the file produces a completely different one. That makes checksums the standard way to detect file corruption during downloads, backups, or transfers — and, with cryptographic algorithms, to detect tampering.
How to verify a download
Most legitimate software vendors publish checksums next to their downloads, often in a file like SHA256SUMS. After downloading, drop the file into this tool, select the matching algorithm, and paste the published value into the comparison box. A green match confirms the file arrived intact and was not modified in transit. A mismatch means you should re-download — and never run the installer.
MD5 vs SHA-1 vs SHA-2
MD5 (128-bit) and SHA-1 (160-bit) are fast but broken for security: attackers can craft different files with the same hash. They remain useful for catching accidental corruption. SHA-256 and SHA-512 (the SHA-2 family) have no known practical collision attacks and are the modern standard for download verification, code signing, and certificate fingerprints.
Hashing large files in the browser
This tool reads the file in 4 MB chunks so the UI stays responsive while hashing multi-gigabyte files. MD5 uses an incremental implementation (spark-md5), while SHA-1/256/512 use the browser's native SubtleCrypto. You can cancel mid-hash at any time.
Frequently asked questions
›What is a file checksum?
A checksum is a fixed-length fingerprint of a file's contents, produced by a hash function. Any change to the file — even one bit — produces a completely different checksum, so checksums are used to detect corruption and verify authenticity.
›Which algorithm should I use?
For integrity checks of downloads, prefer SHA-256 or SHA-512. SHA-1 and MD5 are still common on legacy download pages, but both have known collision attacks and should not be trusted for security-sensitive verification.
›How do I verify a downloaded file?
Find the official checksum on the software vendor's website (e.g. a SHA256SUMS file), select the same algorithm in this tool, drop in your downloaded file, and paste the published value into the comparison box. A green match means the file is intact.
›Is MD5 still safe to use?
MD5 is fine for accidental-corruption checks but is broken for security. Collisions can be generated trivially, so an attacker could swap a file for a malicious one with the same MD5. Never use MD5 to verify code, packages, or certificates.
›Is SHA-1 still safe?
No, not for security. SHA-1 collisions were demonstrated in 2017 (SHAttered) and are now within reach of well-funded attackers. Most modern systems have deprecated SHA-1 for signatures and TLS. Use SHA-256 or SHA-512 instead.
›Why do my checksums differ from the website's?
Common causes: the file was incompletely downloaded, the website lists a different algorithm than you computed, line endings were changed (CRLF↔LF), or you downloaded the wrong file (e.g. signed vs unsigned installer). Re-download and try again.
›What's the maximum file size?
There is no hard limit — files are processed in 4 MB chunks so multi-gigabyte files work, limited only by your browser's memory. Very large files take longer; you'll see a progress bar while hashing.
›Are my files uploaded anywhere?
No. All hashing runs locally in your browser using SubtleCrypto (SHA-1/256/512) and spark-md5 (MD5). Your file never leaves your device — safe for confidential, proprietary, or sensitive content.
›Can I compute multiple checksums at once?
Yes. Select any combination of MD5, SHA-1, SHA-256, and SHA-512 and the file will be read once and hashed with all selected algorithms in parallel.
›What is the difference between a checksum and a cryptographic hash?
All cryptographic hashes (MD5, SHA-2) are checksums, but not all checksums are cryptographic. Simple checksums like CRC32 only detect random corruption. Cryptographic hashes are designed so it's computationally infeasible to find two inputs with the same hash.
More free developer tools
Part of our growing tool belt — all client-side, all free.
MD5, SHA-1 & SHA-256 Hash Generator
Generate cryptographic hashes from text, locally and instantly.
Open toolSHA-256 Hash Generator
Generate SHA-256 hashes from text or files — hex, Base64, and Base64URL output, all in your browser.
Open toolSHA-512 Hash Generator
Generate SHA-512 hashes from text or files — hex, Base64, and Base64URL output, all in your browser.
Open tool