Compute MD5 · SHA-256 checksums for any file in the browser

How to verify a downloaded file's checksum

Most sites that distribute installers or firmware publish a SHA-256 checksum alongside the download. If the hash of your downloaded file matches the published value, the file arrived intact and untampered.

Select a file and paste the expected hash — the matching algorithm among the four is detected automatically. If nothing matches, re-download the file and check again.

Get the same result in your terminal

The hashes computed here match the output of the standard OS commands. Use these when verifying on a server or in CI.

shasum -a 256 file.zip
# or
sha256sum file.zip

md5 file.zip        # macOS
md5sum file.zip     # Linux

certutil -hashfile file.zip SHA256

Get-FileHash file.zip -Algorithm SHA256

Which algorithm should I use?

• MD5 — 128-bit. Duplicate detection and cache keys; collisions are practical, so unsafe for security
• SHA-1 — 160-bit. Legacy-system compatibility only; not recommended for new use
• SHA-256 — 256-bit. The default choice for download integrity, signatures, and published checksums
• SHA-512 — 512-bit. High-security requirements; can outperform SHA-256 on 64-bit hardware

FAQ

Q. Is my file uploaded to a server? No. Hashes are computed locally with the browser's Web Crypto API; the file's contents never leave your machine, so sensitive files are safe to verify.

Q. How large a file can it handle? Files are streamed in 8MB chunks, so multi-gigabyte files hash without running out of memory. Processing time scales with file size and device speed.

Q. Should I use MD5 or SHA-256? Use SHA-256 whenever security matters — download verification, signatures. MD5 collisions can be crafted deliberately, so it only suits non-adversarial jobs like duplicate detection or cache keys.

Pairs well with

Jump to other JSON2Class utilities that naturally follow this one.