File Checksum Verifier

A checksum is a short fingerprint of a file’s contents. Linux distributions, installers and firmware pages publish one next to each download so you can tell whether the copy on your disk is exactly the copy they built. This page does the comparison for you: drop the file, paste the published value, and it reports a match or a mismatch without sending the file anywhere.

How the comparison works

The tool reads the dropped file into memory and runs it through the hash functions built into your browser. It decides which functions to use by looking at the expected value: a 64-digit hex string can only be SHA-256 in practice, a 32-digit one is MD5. If you paste the contents of a whole checksum file, every line is parsed, and each dropped file is matched to the line carrying its name. Both the classic hash filename layout from sha256sum and the BSD form SHA256 (filename) = hash are accepted, and a leading asterisk before the name, which marks binary mode, is ignored.

A worked example

The Sample button loads three lines and three tiny files. empty.txt is zero bytes long, and the list gives it the SHA-256 e3b0c442…b855, the well-known digest of empty input. empty-md5.bin, also empty, is listed with the MD5 d41d8cd9…e87e. installer.iso holds the five letters “hello” and is listed with the SHA-256 2cf24dba…9824. The page reports a match for all three, each time naming the algorithm that matched, and prints both the MD5 and SHA-256 it calculated for every file, for example 5d41402abc4b2a76b9719d911017c592 as the MD5 of “hello”.

What a match proves

A match proves that your copy equals the one the checksum was computed from. That rules out an interrupted download, a flipped bit on a bad disk and a wrong edition. It does not prove the original is safe. If an attacker can replace a file on a download server, they can usually replace the checksum beside it. Take the value from a different channel when it matters: the project’s HTTPS page, a signed announcement, a package manager’s metadata.

Reading a mismatch

On a mismatch the page tells you which algorithm the expected value looks like and says the file’s value differs. Check the boring causes first: you may have the wrong version, a download that stopped early, a file that a browser or antivirus rewrote, or a text file whose line endings were converted. Compare file sizes with the size on the download page, then download again over a stable connection.

MD5 and SHA-1

Both still catch accidental damage. Neither is safe against a deliberate attacker, who can build two different files with the same MD5 or SHA-1 value. When a publisher offers SHA-256, use it, and treat an MD5 match as a convenience check only.

Limits

Very large files are read whole, so a multi-gigabyte image may exhaust memory on a phone. The page compares hashes only; it cannot verify a GPG or minisign signature, and it never contacts the publisher.

Related tools

• Hash Generator calculates common hashes of text or a file without a comparison step.
• Hash Identifier helps when you have a hash but do not know which algorithm made it.
• File Type Identifier shows what a file really is from its first bytes.
• SHA-3 and Keccak Hash Generator covers the newer hash family.