Overview
Verify a file with local checksums
A checksum is a fixed-length fingerprint of a file. Run the file through a hash function like MD5 or SHA-256 and you get a string of hex characters that changes completely if even a single byte of the file changes. Publishers list these checksums next to downloads so you can confirm the file you received is byte-for-byte the file they shipped, with nothing corrupted in transit and nothing tampered with along the way.
ToolHub local file hash checker computes MD5, SHA-1, SHA-256, and SHA-512 for any file you pick. Paste the expected hash from the download page and it tells you immediately whether they match. The file is read in your browser and never uploaded anywhere.
Step-by-step
How to check a file hash
- 1
Select your file
Click the upload area and choose any file. It is read locally as an ArrayBuffer, so even large files stay on your machine. - 2
Read the computed checksums
The tool shows the file name and size along with all four hashes. Each one has its own copy button. - 3
Paste the expected hash
Drop the checksum the publisher listed into the optional field. A clear match or no-match banner appears, comparing your value against every computed hash, ignoring upper and lower case.
Background
Which hash should you compare against
You do not need to know in advance which algorithm a publisher used. The tool computes all four and compares your pasted value against each of them, so whether the download page lists an MD5, a SHA-1, or a SHA-256, a single paste finds the match.
MD5 and SHA-1 versus SHA-256 and SHA-512
MD5 and SHA-1 are fast and still common for spotting accidental corruption, but both are broken for security purposes because attackers can craft collisions. For verifying that a download has not been maliciously altered, prefer SHA-256 or SHA-512, which have no known practical collision attacks.
Why the comparison ignores case
Hex digests are the same value whether written in uppercase or lowercase. Publishers are inconsistent about which they use, so the match check lowercases both sides before comparing. That way A1B2 and a1b2 are treated as equal.
Use cases
When to verify a file hash
Confirming OS and ISO downloads
Linux distributions and installers publish SHA-256 checksums so you can verify a large ISO downloaded cleanly before flashing it.
Validating software releases
Match a downloaded installer against the checksum on the project's release page to be sure it was not corrupted or swapped.
Detecting changed files
Hash a file before and after a transfer or backup to confirm the copy is identical to the original.
Checking attachments
Verify that a file someone sent you matches the hash they quoted, ruling out corruption in email or chat.
Generating checksums to publish
Compute the SHA-256 of your own release artifact so you can list it for your users to verify.
Spotting duplicate files
Two files with the same hash have identical contents, a quick way to confirm a duplicate.
Tips and best practices
- Prefer SHA-256 or SHA-512 when the goal is security, not just catching accidental corruption.
- A matching hash proves the contents are identical to the source you copied the hash from. It does not by itself prove the source is trustworthy.
- Copy the expected hash carefully. A single wrong character produces a false no-match.
- Hashing is content based, so renaming a file does not change any of its checksums.
- Large files take a moment to read and hash. The fields show a computing state while the work runs.
Common questions
Is my file uploaded anywhere?
No. The file is read in your browser with the FileReader and Web Crypto APIs and hashed locally. Nothing is sent over the network, so even confidential files are safe to check.
Why does the same file always give the same hash?
Hash functions are deterministic. The same bytes always produce the same digest, which is exactly what makes a checksum useful for verification. Change one byte and the digest changes entirely.
What does no match mean?
It means none of the four computed hashes equals the value you pasted. Usually the file differs from the original, the download was corrupted, or the expected hash was copied incorrectly. Re-download and re-check if you were verifying a download.
Can I trust MD5 for security?
Not for security. MD5 is fine for catching accidental corruption but attackers can build different files with the same MD5. Use SHA-256 or SHA-512 when you need to confirm a file has not been tampered with.
100% private