ToolHub

File Hash Checker

Verify file checksums locally

Local File Hash Checker

Nothing is uploaded

Pick a file to compute its MD5, SHA-1, SHA-256, and SHA-512 checksums, then paste a published hash to verify the download is intact and untampered. The file is read locally with the browser FileReader and Web Crypto APIs and is never uploaded.

Overview

Verify a file with local checksums

A checksum is a fixed-length fingerprint of a file. Run the file through a hash function like MD5 or SHA-256 and you get a string of hex characters that changes completely if even a single byte of the file changes. Publishers list these checksums next to downloads so you can confirm the file you received is byte-for-byte the file they shipped, with nothing corrupted in transit and nothing tampered with along the way.

ToolHub local file hash checker computes MD5, SHA-1, SHA-256, and SHA-512 for any file you pick. Paste the expected hash from the download page and it tells you immediately whether they match. The file is read in your browser and never uploaded anywhere.

Step-by-step

How to check a file hash

  1. 1

    Select your file

    Click the upload area and choose any file. It is read locally as an ArrayBuffer, so even large files stay on your machine.
  2. 2

    Read the computed checksums

    The tool shows the file name and size along with all four hashes. Each one has its own copy button.
  3. 3

    Paste the expected hash

    Drop the checksum the publisher listed into the optional field. A clear match or no-match banner appears, comparing your value against every computed hash, ignoring upper and lower case.

Background

Which hash should you compare against

You do not need to know in advance which algorithm a publisher used. The tool computes all four and compares your pasted value against each of them, so whether the download page lists an MD5, a SHA-1, or a SHA-256, a single paste finds the match.

MD5 and SHA-1 versus SHA-256 and SHA-512

MD5 and SHA-1 are fast and still common for spotting accidental corruption, but both are broken for security purposes because attackers can craft collisions. For verifying that a download has not been maliciously altered, prefer SHA-256 or SHA-512, which have no known practical collision attacks.

Why the comparison ignores case

Hex digests are the same value whether written in uppercase or lowercase. Publishers are inconsistent about which they use, so the match check lowercases both sides before comparing. That way A1B2 and a1b2 are treated as equal.

Use cases

When to verify a file hash

Confirming OS and ISO downloads

Linux distributions and installers publish SHA-256 checksums so you can verify a large ISO downloaded cleanly before flashing it.

Validating software releases

Match a downloaded installer against the checksum on the project's release page to be sure it was not corrupted or swapped.

Detecting changed files

Hash a file before and after a transfer or backup to confirm the copy is identical to the original.

Checking attachments

Verify that a file someone sent you matches the hash they quoted, ruling out corruption in email or chat.

Generating checksums to publish

Compute the SHA-256 of your own release artifact so you can list it for your users to verify.

Spotting duplicate files

Two files with the same hash have identical contents, a quick way to confirm a duplicate.

Tips and best practices

  • Prefer SHA-256 or SHA-512 when the goal is security, not just catching accidental corruption.
  • A matching hash proves the contents are identical to the source you copied the hash from. It does not by itself prove the source is trustworthy.
  • Copy the expected hash carefully. A single wrong character produces a false no-match.
  • Hashing is content based, so renaming a file does not change any of its checksums.
  • Large files take a moment to read and hash. The fields show a computing state while the work runs.

Common questions

Is my file uploaded anywhere?

No. The file is read in your browser with the FileReader and Web Crypto APIs and hashed locally. Nothing is sent over the network, so even confidential files are safe to check.

Why does the same file always give the same hash?

Hash functions are deterministic. The same bytes always produce the same digest, which is exactly what makes a checksum useful for verification. Change one byte and the digest changes entirely.

What does no match mean?

It means none of the four computed hashes equals the value you pasted. Usually the file differs from the original, the download was corrupted, or the expected hash was copied incorrectly. Re-download and re-check if you were verifying a download.

Can I trust MD5 for security?

Not for security. MD5 is fine for catching accidental corruption but attackers can build different files with the same MD5. Use SHA-256 or SHA-512 when you need to confirm a file has not been tampered with.

100% private

Privacy and security

Your file is read and hashed entirely in your browser using the built-in FileReader and crypto.subtle digest APIs, with MD5 computed locally in JavaScript. Nothing is uploaded, so the file never leaves your device.

Related tools

Frequently asked questions

Is my file uploaded anywhere?

No. The file is read and hashed locally in your browser. It never leaves your device.

Which hashes are computed?

MD5, SHA-1, SHA-256, and SHA-512, so you can match whatever a download page provides.

How do I verify a download?

Paste the expected hash from the source and the tool shows whether any computed hash matches it.