File integrity and hash verification engine

File Checksum Calculator & Verifier

Calculate the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hash values of the file and compare it with the official Checksum with one click. Supports Drag & Drop, multi-file mode, and automatic recognition of Checksum formats. Pure front-end local computing, files are never uploaded.

Drag files to this area

or

Supports any file type, no size limit (pure front-end local computing)

Sample test

Use the default example Checksum verification tool function (SHA-256 comparison).

MD5 (32 chars)
d41d8cd98f00b204e9800998ecf8427e
SHA-256 (64 chars)
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Hash algorithm teaching

What is MD5?

MD5 (Message Digest Algorithm 5) is a 128-bit hash function designed by Ronald Rivest in 1991. It outputs a fixed 32-character hexadecimal string. MD5 has fast operation speed and is often used for file integrity checking and comparison in non-security scenarios. However, MD5 has been proven to have a serious collision vulnerability (cracked by the team of Chinese scholar Wang Xiaoyun in 2004).It should not be used in security scenarios such as password storage or digital signatures.。

Why is SHA-1 no longer secure?

SHA-1 (Secure Hash Algorithm 1) outputs 160 bits (40 characters) and was once the industry standard. However, in 2017, Google and CWI Amsterdam successfully demonstrated the SHAttered attack (the first SHA-1 collision), confirming that it is no longer strong enough to resist modern attacks. NIST officially deprecated SHA-1 in 2011, recommending a full migration to SHA-256 or higher. GitHub also deprecated SHA-1 in 2017.

What is SHA-256?

SHA-256 belongs to the SHA-2 family, outputs 256 bits (64 characters), and is designed by the US NSA and standardized by NIST. Hash algorithms are currently widely considered to be secure and are used for:
• TLS/SSL certificate
• Blockchain and Cryptocurrencies (Bitcoin uses double layer SHA-256)
• Linux ISO and software package verification
• Password storage (with Salt)
There are currently no known feasible collision attacks.

How to verify a Linux ISO?

Take Ubuntu as an example:
1. Download the ISO file and the corresponding SHA256SUMS Archives
2. Drag ISO into this tool and calculate SHA-256
3. from SHA256SUMS Copy the official Checksum in
4. Paste the comparison field and confirm it as 🟢 Match
If the comparison fails, it means that the ISO may have been damaged or tampered with during the download process, please download again.

How to verify Android ROM?

Be sure to verify the integrity of the ROM before flashing:
1. Download the ROM and the corresponding MD5/SHA256 hash value from the developer’s official website
2. Use this tool to calculate the hash value of the ROM file
3. Is the comparison consistent with the official announcement?
⚠️ If the hash does not match, flashing may cause bricking or security issues, so do not install it.

Frequently Asked Questions (FAQ)

What is a checksum? Why use it?
Checksum is a fixed-length string calculated from the file contents using a hash algorithm. As long as the file content changes by one bit, the Checksum will be completely different. Uses include:
• Verify that the downloaded file is complete (not damaged due to network problems)
• Confirm that the file has not been tampered with or malicious code has been inserted
• Integrity check of backup data
Which one should I choose between MD5, SHA-1 and SHA-256?
It is recommended to use SHA-256 first. MD5 and SHA-1 are no longer recommended for security verification due to collision attacks. However, you can continue to use MD5 in the following situations:
• Compatible with older systems (some NAS and older software only provide MD5)
• Non-security scenarios (such as comparing cache files)
This tool will calculate all five algorithms at the same time, allowing you to choose according to your needs.
Why are the MD5 of the two archives the same but the SHA-256 different?
It shouldn't happen under normal circumstances. If this happens, it means that MD5 has collided, and two different files have produced the same MD5 value. This is a known weakness of MD5 and illustrates exactly why SHA-256 should be used instead of MD5.
How is the checksum format automatically recognized?
Automatically determine based on the length of the hexadecimal string:
• 32 characters → MD5
• 40 characters → SHA-1
• 56 characters → SHA-224
• 64 characters → SHA-256
• 96 characters → SHA-384
• 128 characters → SHA-512
You don't need to know in advance what kind of hash it is, you can directly paste it to compare the results of the corresponding algorithm.
File uploaded to server? Is privacy safe?
Not uploaded at all. All calculations are performed locally in your browser, using the Web Crypto API (SubtleCrypto) for SHA calculations. The files will not leave your computer and can be used normally even if you are disconnected from the Internet. That's why this tool can handle gigabyte-sized files without being limited by upload bandwidth.
Why is calculating SHA-512 slower than MD5?
SHA-512 uses 64-bit operations and outputs 512 bits (128 characters). The computational complexity is much higher than MD5 (128-bit output, 32-bit operation). In modern browsers, SHA-256/SHA-512 has hardware-accelerated support (the Web Crypto API uses a native implementation) and can still typically complete calculations on gigabyte files in seconds. MD5 does not have hardware acceleration and relies on pure JS implementation, but because of its simpler algorithm, it is still very fast.