Candid Tools

File Hash Checker

File Hash Checker computes SHA-256, SHA-1, SHA-512 or MD5 checksums of files or text in your browser and checks them against an expected hash.

Algorithms:

At a glance

Accepts
Any file of any size (several at once), or typed text, plus an optional expected hash
Outputs
Hex checksums to copy, with a match or mismatch against the expected hash
Where it runs
Entirely in your browser, on your device
What leaves your device
Nothing - the file never leaves your device
Limits
No size cap: files are read in 4 MB chunks, so speed depends on your disk and CPU
Account
Not required - there is no sign-up
Price
Free, with no watermark and no usage cap
Made by
Visrut
Last updated
11 October 2026

A checksum is a short fingerprint of a file: change one byte and it changes completely. Download pages publish one so you can confirm the file you got is the file they released, not a truncated download or a swapped one. Drop files here to get their SHA-256, SHA-1, SHA-512 or MD5, and paste the published value to check it. Files are read in small chunks in your browser and never uploaded, so multi-gigabyte ISOs work too.

How to use it

  1. Optionally paste the expected hash. Its algorithm is picked from its length (MD5 32, SHA-1 40, SHA-256 64, SHA-512 128 hex characters) and switched on for you.
  2. Drop one or more files, or pick them. Each is hashed in turn with a progress bar; Cancel stops a long one.
  3. A green Matches or red Doesn't match appears next to the hash being compared. Copy any hash with its button.

Command-line check

The same values come from shasum -a 256 file or md5 file on macOS, sha256sum file on Linux, and Get-FileHash file -Algorithm SHA256 in PowerShell.

Frequently asked questions

Are my files uploaded?

No. The browser reads each file from your disk in small chunks and hashes it in a background worker on this page. No part of the file, and no hash, is sent anywhere.

How do I verify a download?

Copy the checksum from the download page (often in a SHA256SUMS file or next to the download link), paste it into the expected hash box, then drop the file. The algorithm is detected from the hash's length, and the page says whether it matches. Case, spaces and line breaks don't matter.

Can it hash very large files, like an ISO?

Yes. Files are read 4 MB at a time and never loaded into memory whole, so a multi-gigabyte image works. Speed depends on your disk and CPU, and progress shows as it goes.

Which algorithm should I use?

Whichever the publisher lists, since you can only compare like with like. SHA-256 is the usual choice today. MD5 and SHA-1 are broken against deliberate collisions (RFC 6151, RFC 6194), so a match with them catches a corrupted download but is weak proof that nobody tampered with the file.

Why doesn't my text hash match the one from the command line?

Text is hashed exactly as typed, encoded as UTF-8. `echo` adds a newline at the end, so `echo hello | sha256sum` hashes 'hello' plus a line break. Use `printf 'hello'` or `echo -n` to compare.

Which formats can I paste as the expected hash?

A bare hex hash, a line of sha256sum output ('<hash> file.iso'), BSD style ('SHA256 (file.iso) = <hash>'), a 'sha256:' prefix, or an SRI value like 'sha256-<base64>'.