File hash calculator: get MD5 and SHA checksums free, without uploading
To calculate a file hash free and privately, choose your algorithms (MD5 and SHA-256 are switched on by default), then click the upload area or drag your files onto it. Each file's hashes appear as soon as it has been read. To verify a download, paste the checksum the publisher lists into the Verify box and the page answers Match or No match. The files are hashed in your browser and are never uploaded.
A file hash, also called a checksum, is a fixed-length fingerprint calculated from every byte of a file. Change one bit and the fingerprint changes completely, so two files with the same SHA-256 hash are, for every practical purpose, the same file. That makes checksums the standard way to confirm a download or backup arrived intact.
This calculator hashes files. To hash a string you type, use the SHA-256 hash generator or the MD5 hash generator.
Table of Use: common checksum jobs and the steps for each
| Job | What to do | What you get |
|---|---|---|
| Verify a Linux ISO or installer | Switch on SHA-256, drop the file, paste the published hash or sha256sum line | A green Match, with the matching file named |
| Check a script's Subresource Integrity value | Drop the script file, paste the sha256- or sha512- value | The Base64 value is converted and compared with the file's hash |
| Confirm two copies are identical | Drop both files and compare their SHA-256 values, or paste one value into the Verify box | Identical hashes mean identical bytes; the Match line names both files |
| Publish checksums with a release or backup | Choose the algorithms, drop every file, click Download checksums.txt | One BSD-style line per file and algorithm, grouped by algorithm |
If the two files are text and the hashes differ, the text diff tool shows exactly what changed.
Features of this checksum calculator
- Four algorithms. MD5 (32 hex characters), SHA-1 (40), SHA-256 (64) and SHA-512 (128). Switching one on later also calculates it for the files already listed.
- Any number of files, any size. Files are hashed one at a time, each with a progress bar. Up to 256 MB they are read whole and SHA hashes come from the Web Crypto API; MD5 and larger files go through crypto-js in 2 MB chunks, so a multi-gigabyte image never sits in memory.
- Verify box. Accepts a bare hash in either letter case, a sha256sum or md5sum line, a BSD-style line, a sha256: prefix or an SRI value. A matching hash is highlighted green in the results, and a hash for a switched-off algorithm tells you which one to turn on.
- checksums.txt export. Lines such as
SHA256 (name) = hash, whichshasum -candsha256sum -cread. Each checker verifies its own lines and harmlessly warns about the others. - Per-file controls. Copy any hash, remove one file with the cross, or clear the list. A file that cannot be read is reported on its own card without stopping the rest.
MD5, SHA-1, SHA-256 and SHA-512 compared
| Algorithm | Length | Use it for |
|---|---|---|
| MD5 | 128 bits, 32 hex characters | Spotting accidental corruption, or matching a publisher that only lists MD5. Collisions can be created on purpose. |
| SHA-1 | 160 bits, 40 hex characters | Legacy checks. The first public collision came in 2017, and NIST plans to retire it by 31 December 2030. |
| SHA-256 | 256 bits, 64 hex characters | The usual choice for software downloads and package managers. |
| SHA-512 | 512 bits, 128 hex characters | The same SHA-2 family as SHA-256 with a longer output, where a publisher lists it. |
Hashes are shown in hexadecimal; the hex to binary converter turns one into bits. An SRI value is the same digest written in Base64, which the Base64 decoder can unpack. A hash is one-way and cannot be reversed; to scramble text you can later read back, use the text encryption tool.
Privacy: what leaves your device
Nothing about your files is sent. The browser reads each file from disk and hashes it locally. The only download is the crypto-js library, a piece of site code fetched from ZipConvert itself the first time MD5 or a file over 256 MB needs it. To embed a file as text instead, the data URL converter and the Base64 encoder do that, also in your browser.
How to calculate and verify a file hash, step by step
- Under Algorithms, switch on the ones you need. A tick shows an algorithm is on. With none selected, nothing is hashed.
- Click “Click to choose files, or drag and drop them here”, or drag files onto it. Each file shows a progress bar while it is hashed.
- Read each hash in the Results list; the clipboard icon copies one.
- To verify, paste the published checksum into Verify against a known hash. It appears once a file has been added. Look for “Match” or “No match”.
- Click Download checksums.txt to save every result, or Clear to empty the list.
Who can use it
- Anyone downloading software who wants to confirm an ISO, installer or archive arrived intact before running it.
- System administrators and IT support comparing a server file with its source copy.
- Developers and release managers producing checksum files for builds, or checking an SRI value before pinning a script.
- People keeping backups or evidence who must show a copy is unchanged.
FAQs
How do I verify a download's checksum?
Find the checksum the publisher lists next to the download, often in a SHA256SUMS file. Switch on the same algorithm here, drop the downloaded file onto the upload area, and paste the published value into the Verify box. A green Match means your copy is byte-for-byte identical to the file the hash was made from.
Is it safe to hash a confidential file here? Is the file uploaded?
The file is not uploaded. Your browser reads it from your disk and the hashes are computed on your own device, with the Web Crypto API for SHA-1, SHA-256 and SHA-512 and the crypto-js library for MD5 and very large files. No file content and no hash is sent to any server. You can confirm that in the Network tab of your browser's DevTools while a file is being hashed.
Is there a file size limit for the hash calculator?
There is no fixed limit. Files up to 256 MB are read in one go and the SHA hashes come from the browser's built-in implementation. Larger files are read in 2 MB chunks and hashed incrementally, so memory use stays small even for a multi-gigabyte disk image. A progress bar shows how far each file has got.
Should I use MD5 or SHA-256 to check a file?
Use whichever the publisher listed, because you can only compare like with like. If you are choosing for your own files, pick SHA-256. MD5 and SHA-1 still detect accidental corruption, but people can deliberately craft two different files with the same MD5 or SHA-1 value, so neither should be trusted against tampering. NIST has said it will phase SHA-1 out by 31 December 2030.
What formats can I paste into the Verify box?
You can paste a plain hex hash in upper or lower case, a line copied from a sha256sum or md5sum file, a BSD-style line such as SHA256 (file.iso) = followed by the hash, a value prefixed sha256:, or a Subresource Integrity value starting sha256- or sha512-. The algorithm is taken from the label when the line names one, otherwise from the length, and you are told if that algorithm is switched off. SHA-384 values are reported as unsupported.
How do I check a file hash on Windows, Mac or Linux without a website?
On Linux run sha256sum file.iso, or md5sum, sha1sum or sha512sum. On macOS run shasum -a 256 file.iso, or md5 file.iso. On Windows PowerShell run Get-FileHash file.iso -Algorithm SHA256, or in Command Prompt run certutil -hashfile file.iso SHA256. The results are the same hexadecimal values shown by this calculator.
Why does my file hash not match the published one?
The usual causes are an interrupted or corrupted download, a different version than the one the hash belongs to, a hash for the archive when you hashed the file inside it, or comparing an MD5 value with a SHA-256 hash. Download the file afresh and hash it again. A mismatch on a fresh download is a reason not to open the file.
Does a matching hash prove the file is safe?
No. A match proves your file equals the one the hash was made from, nothing more. If an attacker replaced both the download and the checksum on the same website, the check would still pass, which is why some projects also publish signed checksum files. Check where the checksum came from before trusting it.