File Checksum Verifier
Hash a downloaded file with MD5 or SHA and compare it against the published checksum.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
Hashes a file on your device with MD5, SHA-1, SHA-256, SHA-384 or SHA-512 (default SHA-256) and compares the digest against the checksum the vendor published. The comparison is case-insensitive, tolerates spaces, newlines and a 0x prefix, and distinguishes a mangled paste — reported as a format error, with the expected hex length per algorithm — from a real mismatch, so a typo can never masquerade as a failed verification. Files up to roughly 100 MB hash in one pass; the file is never uploaded.
When to use it
Questions
My checksum shows MISMATCH — is the file bad?
First rule out the boring causes: you hashed with a different algorithm than the vendor published, or pasted the checksum of a different file or version. If those check out, a genuine mismatch means the file is corrupted or altered — redownload from the official source and compare again before running anything.
Why is a broken paste an error instead of a mismatch?
Because the two mean different things. A mismatch is a real comparison with a real answer — this file is not the one the checksum describes. A format error means no comparison happened: wrong length for the algorithm or non-hex characters, so trusting either verdict would be a guess. The tool keeps the two signals separate so a typo can never look like a security check.
Why do vendors still publish MD5 and SHA-1?
Habit and legacy tooling: old download pages, package lists and hardware docs still emit them. Both are broken for collision resistance, but for verifying a download you fetched over HTTPS, any of the published digests — including MD5 — will catch corrupted or truncated transfers. When a vendor publishes several, prefer SHA-256.
Does a matching checksum prove the file is safe?
It proves integrity — the file matches what the publisher served — not authenticity. If the download site itself is compromised, the published checksum describes the malware just as faithfully. Cryptographic signatures (GPG, Sigstore) verify who produced a file; checksums verify that what you have is what they published.