How do I check the hash of a file?

Choose your file to calculate its checksum, then paste the reference value into Expected Hash to compare it. Hashing starts automatically and the initial algorithm is SHA-256, which produces 64 hexadecimal characters. You can also leave the reference field empty and use Copy on the computed digest. A match checks the supplied checksum; it does not independently establish who published the file.

How do I check SHA-256 or SHA-512 against a published checksum?

Paste the publisher's checksum into Expected Hash and select the file you downloaded. A recognized 64-character hexadecimal value selects SHA-256; 128 characters select SHA-512. The tool also accepts a SHA256SUMS line or a BSD checksum line and extracts the digest. Check the detected algorithm against the publisher's instructions, since automatic detection identifies a supported format rather than authenticating the source.

What is the SHA-256 hash beginning with e3b0c44298fc1c14?

The full digest e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 is the SHA-256 checksum for zero bytes. This verifier supports empty files, so selecting a zero-byte file with SHA-256 produces that result. It is not the hash of a file containing spaces or a newline. If you expected a populated download, inspect the file size before treating an empty-file checksum match as useful verification.

Why does file hash verification show a mismatch?

A mismatch means the computed digest differs from the normalized expected value. Check that Hash Algorithm matches the source, that the checksum belongs to the exact download, and that you pasted one supported checksum line. Uppercase letters and whitespace in the digest are normalized, so letter case alone does not cause failure. You can correct Expected Hash after processing; comparison updates without hashing the file again.

Can I verify a large file without uploading it?

Yes. The verifier streams your local file through a Web Worker using 4 MiB blocks, equivalent to 4,194,304 bytes, and computes all six supported algorithms in one pass. The uploader imposes no fixed file size cap. Files over 4 GiB trigger a warning about mobile processing time. Progress shows processed bytes and MB/s, and Cancel processing stops the task and clears its computed results.

File Hash Verifier

Compare a file against a checksum, with six algorithms, automatic detection, and cancellable progress.

Hash Algorithm

Expected Hash

Case-insensitive. Provided by the software publisher or original source.

Choose a file or drag & drop

or paste from clipboard (Ctrl+V)

Runs locally in your browser. Nothing is uploaded or sent to a server.

Choose a file and paste its expected checksum into Expected Hash to get the computed digest and a match or mismatch result. The File Hash Verifier starts with SHA-256 and detects supported algorithms from hexadecimal checksum length. It also accepts SHA256SUMS and BSD checksum lines. All six algorithms run locally in one pass, so changing the selected algorithm after processing does not reread the file. Leave Expected Hash blank to compute and copy a digest without comparing it.

Updated November 6, 2026

privacy-tools

File Encryptor

Protect a file with a passphrase using the open age format.

developer-tools

ZIP Extractor

Look inside. Take only what you need.

audio-tools

Voice Recorder

One clear take, from microphone to local file.

audio-tools

Audio Cutter

Select the sound you need. Keep it, or cut it out.

developer-tools

Hash Calculator

Calculate six checksums locally, inspect text bytes, and copy Hex, Base64 or SRI output.

privacy-tools

Password Strength Checker

Check a password's strength, weak patterns, and estimated crack time, all on your device.

How do you check the hash of a file against a checksum?

Choose a file, paste the reference checksum into Expected Hash, and read the match or mismatch result. Hashing starts as soon as you select the file; there is no separate Verify button. Hash Algorithm starts at SHA-256, and a recognized pasted digest selects its corresponding supported algorithm automatically.

For a reproducible example, select a zero-byte file and leave SHA-256 selected. Its computed digest is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Paste that value into Expected Hash and the result reads “Hash match - file integrity verified.” A file containing the three ASCII bytes abc, with no newline, instead produces ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. These examples distinguish an empty file from a short text file.

Leave Expected Hash blank when you only want to check a file's digest. The computed value still appears with a Copy button, but there is no match verdict until you supply a reference. For hashing typed text rather than a local file, use Hash Calculator.

Which hash algorithm should you select?

Use the algorithm named by the checksum source. SHA-256 and SHA-512 are different functions, so their outputs cannot be compared interchangeably. SHA-256, SHA-384, and SHA-512 belong to the SHA-2 family described in FIPS PUB 180-4. This tool offers six choices and displays their hexadecimal lengths in the menu.

Supported checksums and lengths used for automatic detection
Algorithm	Hexadecimal characters	Output bits
CRC32	8	32
MD5	32	128
SHA-1	40	160
SHA-256	64	256
SHA-384	96	384
SHA-512	128	512

Each hexadecimal character represents four bits. Automatic detection checks hexadecimal content and these six lengths; it does not inspect a publisher's website or determine the provenance of a checksum. The result panel warns “Detects accidental corruption, not tampering.” for MD5, SHA-1, and CRC32. Do not treat those options as proof against deliberate substitution.

Can you paste a SHA256SUMS or BSD checksum line?

Yes. Paste one checksum entry, rather than an entire manifest containing multiple files. The parser recognizes a digest followed by whitespace and a filename, including the optional asterisk before the filename. It also recognizes BSD notation such as SHA256 (empty.bin) = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. The field extracts and normalizes the digest rather than opening the named file.

The filename in a pasted line does not select or validate your local filename. You still choose the file yourself. Uppercase and lowercase hexadecimal letters compare equally, and whitespace within a bare checksum is removed. A supported length can select the algorithm; always review Hash Algorithm if the pasted input is incomplete or malformed. This is a single-file comparison interface, not batch manifest verification.

Why might the computed hash differ from the expected hash?

First check the source algorithm and the exact artifact: an archive and its extracted contents are different byte sequences. A file for another platform, another release, or a partially downloaded copy is also a different input. The verifier hashes the file bytes directly; it does not decompress archives, normalize text line endings, or remove a byte-order mark before hashing.

A text editor that saves an additional newline changes the input, even when the visible text looks identical. To reproduce the three-byte abc example, the file must contain only those three bytes. Correcting Expected Hash or changing Hash Algorithm after processing reuses the stored digests, so you can compare another reference without selecting the file again.

How are large files processed on your device?

The selected file is processed locally in a Web Worker. Its stream is collected into 4 MiB blocks, or 4,194,304 bytes, with a shorter final block when necessary. Every block updates all six hashers in the same pass. The tool does not send the selected file to a hashing server or load the entire file into one application buffer before starting.

The uploader accepts any file type and sets no fixed size cap. That is not a promise of unlimited capacity or a fixed completion time: storage access, device resources, and processing speed still matter. Files larger than 4 GiB show a warning that mobile processing may take a long time. Progress reports bytes and MB/s. Cancel processing stops the task and clears the file's stored digests; selecting the file again starts a new calculation.

Does a matching checksum prove a file is safe?

A match means this file's digest equals the expected value you supplied under the selected algorithm. It is useful for checking integrity against a trusted reference. It is not a malware scan, a digital signature check, or independent authentication of a publisher. Hashes have a finite output space, so a digest is not a mathematically unique identifier for every possible file.

If someone replaces both a download and its published checksum, comparing those two substituted values does not reveal the replacement. Obtain the expected checksum through a source you trust and verify any publisher signature separately when your workflow requires it. The verifier reports equality of digests; deciding whether the reference itself is trustworthy remains a separate step. Browse Privacy Tools for other local file and data utilities.

How to Use File Hash Verifier

Hash Algorithm

Select the algorithm used by your checksum source. The initial selection is SHA-256; the menu also includes MD5, SHA-1, SHA-384, SHA-512, and CRC32.
Expected Hash

Paste the expected hexadecimal checksum or one SHA256SUMS or BSD checksum line. Recognized checksum lengths automatically select the matching supported algorithm. Leave this field blank if you only need a computed hash.
Choose a file or drag & drop

Select your local file. Hashing starts automatically; watch processed bytes and MB/s, or use Cancel processing to stop. There is no separate verification button.
Computed Hash

Read the match or mismatch message when an expected checksum is present. Use Copy to copy the computed digest. Changing Expected Hash compares again without reading the file again.