File Checksum — SHA-256, SHA-1, SHA-384 & SHA-512 (local)
Compute SHA-256, SHA-1, SHA-384 and SHA-512 checksums of any file locally — the file is hashed in your browser and never uploaded. Paste an expected checksum to verify a download instantly.
🔒 Runs entirely in your browser. Your input and output are never sent to a server or stored — fully private.
🧾 The file is hashed in your browser with the Web Crypto API — it is never uploaded, stored, or sent anywhere. Comparison ignores case, spaces and colons.
About this tool
Verify a download without handing the file to anyone: unlike checksum sites that make you upload first, this tool reads the file locally and computes SHA-256, SHA-1, SHA-384 and SHA-512 digests right in your browser with the Web Crypto API. Paste the checksum published by the software's author and the tool compares the two for you, character by character, so a single flipped bit stands out immediately. It handles large files, works offline once loaded, and is ideal for checking installers, ISO images and firmware before you run them.
Frequently asked questions
What does a matching checksum actually prove?
It proves integrity: your copy is bit-for-bit identical to the file the checksum was computed from, so nothing was corrupted or altered in transit. It does not by itself prove authenticity — if an attacker controls the download page, they can publish a matching checksum for a malicious file. Authenticity comes from getting the checksum through a trusted source, such as the project's official site over HTTPS, or better, a cryptographic signature you can verify.
Which algorithm should I pick — and is SHA-1 still okay?
Use whatever the publisher provides — you must match their algorithm for the comparison to mean anything — and prefer SHA-256 when you have a choice. SHA-384 and SHA-512 are equally solid with longer digests. SHA-1 is broken for security: researchers can craft two different files with the same SHA-1 hash, so treat it as a legacy option for old download pages only, never as evidence that a file has not been maliciously replaced.
Is my file uploaded to compute the hash?
No. The file is read straight from your disk into the browser and hashed there with the Web Crypto API; nothing is transmitted, logged or stored, which also makes the tool fast — a checksum appears as quickly as your machine can read the file, with no upload wait. It works offline once the page has loaded, so you can even verify sensitive files, contracts or backups on an air-gapped machine.