How do I verify a downloaded file's checksum here?

Drop the downloaded file onto the box, then paste the checksum the project published into the verify field. If it equals any of the computed digests, a green 'Match' badge appears next to that algorithm and the file is intact.

Which is better for a file checksum, MD5 or SHA-256?

SHA-256 is the safer default — MD5 and SHA-1 can be forged with engineered collisions, so use them only for catching accidental corruption. For verifying an installer or release artifact, always compare the SHA-256 (or SHA-512).

Does the pasted checksum need to be lowercase or exactly formatted?

No. The match is case-insensitive and strips spaces, newlines, and a trailing filename, so you can paste a hash straight from a release page or a sha256sum line without cleaning it up first.

Can this tool hash large ISO or disk-image files?

Yes. Files are read and hashed in fixed-size chunks on your device, so multi-gigabyte ISOs work without loading the whole file into one buffer. Speed depends on your disk and CPU, not a network.

Why do MD5, SHA-1, and SHA-256 give different lengths?

Each algorithm emits a fixed digest size: MD5 is 128 bits (32 hex chars), SHA-1 is 160 bits (40 chars), SHA-256 is 256 bits (64 chars), and SHA-512 is 512 bits (128 chars). The tool labels each one so you compare like with like.

File Hash & Checksum Calculator

Drop any file to compute its MD5, SHA-1, SHA-256 and SHA-512 checksums and verify it against an expected hash — all in your browser.

The File Hash Checksum tool runs entirely in your browser. The file you drop is read on your device and its bytes are never uploaded to ArrayKit — only the resulting hashes are shown to you.

Open the Text Hash Generator

About File Hash Checksum

The File Hash Checksum tool reads a file you drop in and computes its MD5, SHA-1, SHA-256, and SHA-512 digests side by side, so you can confirm a download arrived intact or fingerprint a file for a manifest. Paste the checksum a project publishes on its release page into the verify box and the tool tells you exactly which digest it matches, ignoring case and stray spaces, so a copied "<hash> filename.iso" line still lines up. It is the everyday check before running an installer, flashing an ISO, or trusting an artifact from a mirror. Because hashing happens on your device, even multi-gigabyte files are read in chunks and never leave the browser — nothing is uploaded, so you can verify private or sensitive files safely.

Features

Computes MD5, SHA-1, SHA-256, and SHA-512 for one dropped file at once
Drag-and-drop or click to pick any file, of any type or size
Paste an expected checksum to get an instant, highlighted match verdict
Match is case-insensitive and tolerates spaces, newlines, and a trailing filename
Detects which algorithm your pasted hash is from its length
Copy any individual digest with one click
Large files are hashed in chunks so the tab stays responsive
Runs entirely on your device — file bytes are never uploaded

How to use the File Hash Checksum

Drop a file onto the box, or click it to choose one
Read the MD5, SHA-1, SHA-256, and SHA-512 checksums the tool computes
Paste the expected checksum from the download page into the verify field
Confirm the highlighted 'Match' badge appears next to the matching digest

Example

Input

file: ubuntu-24.04.iso
expected: BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD

Output

SHA-256 ✓ Match — the download is intact

The pasted digest matches the file's SHA-256, ignoring case and spacing.

Common errors & troubleshooting

The expected hash shows 'No match' but you think the file is fine. — Make sure you copied the whole digest and compared the right algorithm — an MD5 (32 chars) will never equal a SHA-256 (64 chars). Re-copy from the source's published checksum.
The publisher lists the checksum in a .sha256sum file with the filename after it. — Paste the whole line — the tool keeps only the leading hex token, so a trailing ' filename.iso' is ignored automatically.
Two different files produced the same MD5. — MD5 is broken against deliberate collisions. Trust the SHA-256 or SHA-512 result for anything security-sensitive; use MD5 only for accidental-corruption checks.
A very large file seems to take a while to hash. — Multi-gigabyte files are read and hashed in chunks on your device; let it finish. Nothing is uploaded, so time depends only on your machine's disk and CPU.

Frequently asked questions

How do I verify a downloaded file's checksum here?: Drop the downloaded file onto the box, then paste the checksum the project published into the verify field. If it equals any of the computed digests, a green 'Match' badge appears next to that algorithm and the file is intact.
Which is better for a file checksum, MD5 or SHA-256?: SHA-256 is the safer default — MD5 and SHA-1 can be forged with engineered collisions, so use them only for catching accidental corruption. For verifying an installer or release artifact, always compare the SHA-256 (or SHA-512).
Does the pasted checksum need to be lowercase or exactly formatted?: No. The match is case-insensitive and strips spaces, newlines, and a trailing filename, so you can paste a hash straight from a release page or a sha256sum line without cleaning it up first.
Can this tool hash large ISO or disk-image files?: Yes. Files are read and hashed in fixed-size chunks on your device, so multi-gigabyte ISOs work without loading the whole file into one buffer. Speed depends on your disk and CPU, not a network.
Why do MD5, SHA-1, and SHA-256 give different lengths?: Each algorithm emits a fixed digest size: MD5 is 128 bits (32 hex chars), SHA-1 is 160 bits (40 chars), SHA-256 is 256 bits (64 chars), and SHA-512 is 512 bits (128 chars). The tool labels each one so you compare like with like.

Related tools

Hash Generator — SHA-256 / SHA-1 / SHA-384 / SHA-512 via the Web Crypto API.
HMAC Generator — Generate an HMAC (SHA-256, SHA-1, SHA-512) from a message and secret key using Web Crypto.
Bcrypt Generator — Hash a password with bcrypt and verify a password against a bcrypt hash, in your browser.
Base64 Encode / Decode — UTF-8 safe Base64 encoding and decoding.
X.509 Certificate Decoder — Decode a PEM or DER certificate to view subject, issuer, validity, SANs and fingerprints.
Password Generator — Generate strong, random passwords with a strength meter (crypto-secure).