Downloaded an ISO, a firmware blob, or a source tarball and want to know it matches the publisher’s checksum? Pick the file above. Hashing runs in your browser in chunks, so even a multi-gigabyte image never goes to a server. For text and HMAC, use the hash generator. This file checksum tool is part of the programming tools on TechOpt.io.
How to verify a download with this file checksum tool
Linux distros, BSDs, and many vendors publish a SHA-256 (sometimes MD5 or SHA-512) next to the file. Hash the copy you saved, then paste their digest into Compare. A match means you have the same bytes they hashed — bit-for-bit. On Linux you can do the same with sha256sum(1). It does not by itself prove the publisher is honest; that is what signed checksum files and HTTPS are for. It does catch a truncated download, a corrupt mirror, or the wrong file.
sha256sum and md5sum
On Linux and macOS you can do the same check in a terminal:
sha256sum ubuntu.iso
md5sum firmware.binThe usual line is the hex digest, two spaces, then the filename:
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 empty.txtPaste that whole line into Compare. This tool keeps the hex and ignores the filename. A leading * (binary mode on some md5sum output) is stripped too. SHA-256 is selected by default because that is what most current ISO pages publish; tick MD5 or SHA-512 only when the vendor still lists those.
MD5 vs SHA-256 for checksums
MD5 still shows up on older mirrors. It will catch accidental corruption. It will not stop someone who can produce a colliding file on purpose. Prefer SHA-256 or SHA-512 when the vendor offers them. SHA-1 is in the same “legacy only” bucket as MD5. Hashing several algorithms at once re-reads the file in one pass, but each extra digest costs CPU — leave SHA-384/SHA-512 off unless you need them on a large ISO.
Large files
The checker reads the file in 1 MiB slices so a 4 GB image does not have to sit in RAM as one buffer. Progress updates as it goes; Cancel stops the current run. Speed depends on disk and CPU, not the network — nothing is uploaded.
FAQ
How do I verify an ISO or other download?
Copy the SHA-256 (or MD5) from the publisher’s page. Choose the file you downloaded, wait for the hash, and paste their digest into Compare. A match means the bytes are identical to what they hashed. On Linux you can do the same with sha256sum filename.
What does sha256sum output look like?
A 64-character hex digest, two spaces, then the filename, for example e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 empty.txt. Paste the whole line; this tool uses the hex and ignores the name. md5sum is the same idea with 32 hex characters.
Does this file checksum tool upload my file?
No. It runs entirely in your browser. The file is read locally in chunks and never sent to a server.
MD5 vs SHA-256 for checksums?
Use SHA-256 when the vendor publishes it. MD5 still detects a truncated or corrupt download, but collisions are practical, so it is a poor choice if you need to resist a crafted substitute. Tick MD5 here only to match an older checksum file.
Why is hashing a large file slow?
Every byte has to be read from disk and run through the hash. A 4 GB ISO is 4 billion bytes; that takes a few seconds to a minute depending on the disk and whether you enabled extra algorithms. Progress shows how far the current pass has got. Cancel stops it.
Can I hash a string instead of a file?
Yes. Use the hash generator for UTF-8 text and HMAC. This page is for local files.
Looking for more developer how-tos? Browse the programming guides or the rest of the tools.