Check a download against its published MD5 or SHA-256 checksum
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.Downloaded an ISO, an installer or a firmware image? Choose the file, paste the checksum from the download page, and see a clear match or no match. The algorithm is recognised from the checksum's length, and lines copied straight from a SHA256SUMS file work too. Files of several gigabytes are read in chunks with a progress bar, and nothing is uploaded.
The page opens on File with MD5, SHA-1, SHA-256 and SHA-512 selected.
Click Choose a file, or drop the downloaded file on the box; a progress bar shows large files being read.
Paste the published checksum into "Compare with an expected hash"; a line from a SHA256SUMS file works too.
Read the verdict: Match means the file is exactly the one published, No match means download it again.
This hash generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 for text you type or a file you choose, all at once. Results appear in hex or Base64 with one-click copy, and a compare box tells you plainly whether a file matches the checksum you expected.
The most common use is checking a download: an operating system image, an installer or a firmware file is published with a SHA-256 value, and comparing it proves the copy on your disk is complete and unaltered. Developers also use hashes to build cache keys, to fill Subresource Integrity attributes in HTML, and to check that two files are identical without comparing them byte by byte.
MD5 and SHA-1 are broken for security and should only be used to spot accidental damage. For anything that must resist tampering, use SHA-256 or stronger, and never store passwords as a plain hash. Nothing you type or choose leaves your device. Related tools: Base64 Encode and Decode, Password Generator, UUID Generator.
The rest of the article, and all 6 questions about Hash Generator, are on the Hash Generator page.
Choose File, pick the downloaded file, then paste the checksum from the download page into the Compare box. You get a clear match or no match. The algorithm is detected from the length of the checksum you paste.
Not for security. Researchers can create two different files with the same MD5 or SHA-1 hash. They are still fine for spotting accidental corruption in a download. Use SHA-256 or SHA-512 when tampering matters.
Hex and Base64 are the same hash bytes written two ways. Hex uses 0-9 and a-f, giving 64 characters for a SHA-256, and is the form checksum files and Git use. Base64 packs those same 32 bytes into 44 characters and is what Subresource Integrity attributes and HTTP digest headers expect.
Up to 4 GB. Files up to 256 MB are hashed in one pass with Web Crypto; larger ones are read in chunks with a progress bar, which takes a little longer but keeps memory use low. You can cancel at any time.
Still stuck? Ask about Hash Generator and anybody who knows can answer. No account needed.
On the related tools: Grid Template Areas Generator – Type a page layout as named areas and get grid-template-areas with a rule for each part · Remove Tracking Parameters – Strip utm, fbclid and gclid from a link before you share it · Cron Expression Generator – Generate a cron expression by choosing when the job should run.
In the collection Security Tools for Developers.