How to use it
- Choose one or more files, or drop them on the page.
- Tick the Algorithms you need, then press Compute checksums.
- Paste the checksum from the download page into Expected checksum (optional) to see whether it matches.
- Copy the checksum you need. A checksum of 32 hexadecimal digits is MD5, and one of 64 digits is SHA-256.
What a checksum tells you
A checksum is a short code computed from every byte of a file. The same bytes always give the same code, and a file that has changed, even by one bit, gives a different one. Comparing the code of your copy with the code a publisher gives shows that your copy is the same file, which is the usual reason to compute one after a download.
Which algorithm to use
MD5 (RFC 1321) and SHA-1 have known collisions: two different files with the same checksum can be made on purpose. They still find accidental damage, such as a broken download. SHA-256 and SHA-512 are in the SHA-2 family of FIPS 180-4 and are the usual choice when someone might change the file on purpose. SHA-384 is SHA-512 cut short. CRC-32 is a cyclic redundancy check (RFC 1952 section 8) that finds accidental damage only.
How large files are handled
A file of up to 64 MB is read at once, and its SHA checksums come from the browser's own SubtleCrypto. A larger file, up to 2 GB, is read in pieces of 4 MB, and the checksums are computed by code on this page, which reads each piece once for all the algorithms you ticked. Nothing is uploaded, and the progress bar shows how far the work has come.
Worked example: the text abc
A file whose content is the three letters abc has the checksums published by RFC 1321 for MD5 and by FIPS 180-4 for SHA-256. The table shows the two values that the page gives for that file.
Pasting the SHA-256 value as the expected checksum shows that the file matches SHA-256. A different file shows that it does not match.
| File content | Algorithm | Checksum |
|---|---|---|
| abc | SHA-256 | ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad |
| abc | MD5 | 900150983cd24fb0d6963f7d28e17f72 |
Frequently asked questions
Why do my checksum and the one on the website differ?
The file may be another version, or a download that stopped early, or the site may publish the checksum of a different file. Download the file again and check its name and version against the page.
Which checksum should I use?
SHA-256 is a good default. When you paste the checksum from a download page, its length tells the page which algorithm to compare, so you do not have to choose.
Is MD5 safe for checking a download?
Only against accidental damage. MD5 has known collisions, so someone who wants to replace a file can make a different file with the same MD5. Use SHA-256 or SHA-512 when the file might be changed on purpose.
Does a matching checksum prove that a file is safe?
It proves that your file has the same bytes as the file the checksum came from. It does not prove who made the file: if the checksum comes from an untrusted page, it proves nothing about safety.
Are my files uploaded anywhere?
No. The files are read in your browser, and nothing is sent to our server or stored there.
Why does a large file take a long time?
The page reads the file in pieces and computes each algorithm you ticked in JavaScript. A 2 GB file can take a minute or more on an older computer, so untick the algorithms you do not need.
Sources
- RFC 1321: The MD5 Message-Digest Algorithm
- NIST FIPS 180-4: Secure Hash Standard (SHA-1 and the SHA-2 family)
- RFC 1952: GZIP file format, section 8 (CRC-32)
- Catalogue of parametrised CRC algorithms (CRC-32/ISO-HDLC check value)
Figures and text last checked on Tuesday, November 10, 2026.