Gearboxly

Free File Checksum & Hash

MD5, SHA-1, SHA-256 and SHA-512 of a file.

Runs locallyNo uploadPrivate
Feedback Report issue
Loading tool…

What is the File Checksum & Hash?

When you download software, an ISO or an important file, the publisher often lists a checksum next to it — a fingerprint that proves the file arrived intact and untampered. Comparing it by hand means finding a command-line tool; most people skip it, which is exactly when a corrupted or altered download slips through.

This tool computes a file's checksum in your browser and checks it against the expected value. The file is never uploaded.

Last updated: Sep 1, 2026

What does this tool do?

You pick a file and it computes four hashes — MD5, SHA-1, SHA-256 and SHA-512 — reading the file locally. Paste the checksum the publisher provided into the verify box and it tells you instantly whether it matches, confirming the file is genuine and undamaged.

SHA hashes use the browser's built-in Web Crypto; MD5 is computed in-page. Nothing leaves your device.

Key features

Four algorithms

MD5, SHA-1, SHA-256 and SHA-512.

One-click verify

Paste an expected checksum to compare.

Any file

Works on any file type.

Copy each hash

Grab a value to paste elsewhere.

Private

Read locally; never uploaded.

Example

Input
A downloaded installer plus the publisher's SHA-256 value.
Processing
The tool hashes the file and compares.
Output
✓ Match — the download is intact and unaltered.

Common use cases

  • DownloadersVerify installers, ISOs and archives.
  • DevelopersConfirm build and release artifacts.
  • IT & securityCheck files against known-good hashes.
  • PublishersGenerate checksums to publish.
  • AnyoneMake sure a download isn't corrupted.
  • Privacy-consciousHash sensitive files without uploading.

Benefits

  • Verify downloads without command-line tools.
  • Four algorithms cover any published checksum.
  • Instant match / no-match verdict.
  • The file never leaves your device.

Tips

  • Match the algorithm to what the publisher listed — a SHA-256 value won't equal an MD5 hash.
  • Prefer SHA-256 where offered; MD5 and SHA-1 can be deliberately forged, so they prove accidental corruption more than tampering.
  • Checksums are case-insensitive; the tool ignores case when comparing.
  • If it doesn't match, re-download — a single flipped bit changes the whole hash.
  • For very large files, hashing may take a few seconds as the file is read locally.

Common mistakes to avoid

Comparing different algorithms

Fix: A no-match often just means you pasted a SHA value against MD5 — match the algorithm.

Trusting MD5 for security

Fix: MD5/SHA-1 detect corruption but can be forged; use SHA-256 to guard against tampering.

Worrying about case

Fix: Checksums are case-insensitive; the comparison ignores case.

Assuming the file is uploaded

Fix: It isn't — it's read and hashed locally in your browser.

How it works

  1. 1

    Choose a file

    It's read locally, never uploaded.

  2. 2

    Get the hashes

    MD5, SHA-1, SHA-256 and SHA-512.

  3. 3

    Verify

    Paste an expected checksum to compare.

Frequently asked questions

No — the file is read and hashed entirely in your browser and never sent to a server, so it's safe for private files.

Compute the file's checksum here, then paste the checksum the download's publisher listed into the verify box. A match means the file is intact and unaltered.

Use whichever the publisher provides. SHA-256 is the modern standard; MD5 and SHA-1 are common for legacy verification but are weak against deliberate tampering.

No — the file is read and hashed entirely in your browser and never sent to a server, so it's safe for private files.

Compute the file's checksum, then paste the value the publisher listed into the verify box. A match means the file is intact and unaltered.

Whichever the publisher provides. SHA-256 is the modern standard; MD5 and SHA-1 are common for legacy verification but weaker against deliberate tampering.

Yes — free, no sign-up.

Conclusion

Confirm a download is genuine and undamaged in seconds — compute MD5, SHA-1, SHA-256 and SHA-512 locally and check against the published value, with nothing ever uploaded. Match the algorithm, prefer SHA-256, and re-download on any mismatch.

How-to guides

Related tools