Free tool
Fingerprint a file without uploading it
Calculate SHA-256 and SHA-512 digests for any file and compare them with the value published by the sender. The file is read in this page, so nothing is transferred to check it.
Calculate
Choose a file
Any file type, up to 512 MB. A large file takes longer to read.
Digests
Reference
What a digest is for
- Two identical files produce the same digest
- A single changed byte produces a completely different one
- Comparing a digest catches a truncated or altered download
A matching digest is not a safety verdict It tells you the file is the one the sender hashed. If the published digest came from the same compromised source as the file, both will agree and both will be wrong.
Choosing between SHA-256 and SHA-512
Both are members of the SHA-2 family and neither has a practical collision attack against it today. SHA-256 is the value most download pages publish, so it is the one you can usually compare against. SHA-512 produces a longer string and is a reasonable choice when you are recording a digest for your own records.
Comparing by eye
Long hex strings are easy to misread. Compare them in blocks, or paste the published value next to yours and check the last few characters, which are the ones people tend to skip.
When the digest does not match
Do not open the file. Download it again from the original source, and if the digest still disagrees, treat the copy as unreliable and tell whoever published it.
Is the file uploaded to calculate the digest?
No. The page reads the file locally and uses the browser's own cryptography. There is no request while a digest is being calculated.
Why is a large file slow?
The whole file has to be read to hash it. Near the 512 MB limit, a phone may run out of memory even when a desktop succeeds.
Should I use MD5 instead?
No. MD5 and SHA-1 can be made to collide on purpose, so a match does not prove much. Use SHA-256 unless the publisher only offers something else.