File hash checker
Check that a download is exactly what the publisher released. Your file is hashed on this device and never uploaded.
Nothing leaves your browser: files and text are hashed on this device.
How it works
The file is read and hashed on your device with your browser’s built-in cryptography; it is not uploaded. A cryptographic hash is a fixed-length fingerprint: change a single bit of the file and the hash changes completely. Publishers list the hashes of their downloads so you can confirm you received exactly the file they released.
Reading the result
Paste the published value into the expected hash field. A match means your file is identical to the one the hash was made from. A mismatch means the download is damaged or different, so do not open it. A match only proves something if the hash came from a source you trust, such as the publisher’s own HTTPS site, rather than the same place as the file.
Limitations
SHA-1 is offered for older checksums only, because collisions can be created on purpose. The whole file is read into memory, so files over about 2 GB may fail in some browsers. In text mode the text is encoded as UTF-8, and a final line break changes the result.
Questions
Is my file uploaded?
No. It is read and hashed in your browser. Nothing about the file is sent anywhere.
Which algorithm should I use?
The one the publisher lists, usually SHA-256. SHA-384 and SHA-512 are equally sound. MD5 is not offered because it is broken.
Why does my text give a different hash from the command line?
Usually a final line break: echo adds one, printf does not. Windows line endings (CRLF) and a different character encoding also change the hash.
How do I check a very large file?
Use sha256sum on Linux, shasum -a 256 on macOS, or Get-FileHash with -Algorithm SHA256 in Windows PowerShell.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Consulting and trainingRelated articles
-
Security headers that matter, and the ones to retire
A practical guide to CSP with nonces, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with examples and what to drop.
-
Before you connect company data to an AI assistant
A checklist for IT teams: data classification, hostile input, access control, logging, vendor review and ownership before connecting an LLM.
-
How to design and test secure file uploads
A checklist of controls for file upload features, based on the OWASP cheat sheet, with a table of tests to run against each upload endpoint.