Verify a download with an exact-byte checksum

Understand the settings

A cryptographic hash summarizes exact bytes. A filename change does not change those bytes, but a single edited character, a different newline or a modified archive will change the digest. Select the same algorithm used by the publisher before comparing results.

A match shows that your bytes match the bytes represented by that expected digest, subject to the algorithm’s security properties. It does not show that the file is harmless. If an attacker supplies both the file and its advertised checksum, a matching comparison can still be misleading. Get expected hashes through a trusted channel.

SHA-256 is a practical default for ordinary checksum comparison. SHA-1 is included for compatibility with older published hashes; it should not be chosen for new collision-resistant security designs. This utility is not a password-hashing system.

Step by step

1. Choose a file or text input and the publisher’s algorithm.
2. Calculate the digest. For text, remember that UTF-8 bytes are hashed.
3. Paste the complete expected hexadecimal value to compare it.
4. If it differs, check version, algorithm and whether the publisher hashed the archive or a file inside it.

Use a reproducible test

SHA-256 of the three characters abc, without a trailing newline, is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. Add a newline and calculate again: the digest changes.

Limits and what to check

• Browser file limit: 64 MiB. Web Crypto hashes the loaded data in memory; larger files need a streaming local tool.
• HTTPS is required for Web Crypto in ordinary production browser contexts.
• Case differences in hexadecimal do not change the digest.
• Files/text are processed locally and are not sent to the server.

Troubleshooting