File Checksum Calculator
Compute the SHA-256, SHA-1, SHA-384, or SHA-512 checksum of any local file, with its size. Your file is processed locally and never uploaded.
Input
Your file is processed entirely in your local browser and is never uploaded to any server.
How it works
- The selected file is read into memory with
FileReader/arrayBuffer()and hashed withcrypto.subtle.digest. - Each algorithm produces a fixed-length digest regardless of file size — 160 bits for SHA-1, 256/384/512 bits for the SHA-2 family.
- The checksum is shown in hexadecimal, which is the format used by most download pages and package managers.
- Hashing runs in your browser only; the file never leaves your machine.
About File Checksum Calculator
A checksum (or file hash) is a short fingerprint that changes drastically when even a single bit of the file changes. Its main uses are verifying that a downloaded file matches the publisher's official copy, detecting accidental corruption during transfer or storage, and deduplicating identical files. SHA-256 is the current recommendation — it is fast, universally supported, and collision-resistant — while SHA-1 is considered broken for security purposes and should only be used to match checksums published long ago.
Use this tool whenever you download a binary, a firmware image, or an installer and want to confirm it was transferred intact. Keep in mind that a checksum only proves the file matches the value it was compared against; it does not prove the file is safe. A malicious actor who controls the download can simply publish a matching checksum — for real protection against tampering, verify cryptographically signed hashes from a trusted source (for example, GPG signatures or HTTPS package registries).
Fixed-length output, and what that tells you
SHA-2 compresses input of any length into a fixed-width state: 160 bits for SHA-1, 256 for SHA-256, 384 and 512 for the wider variants. The digest length carries no information about the file — not its size, not how many bits differ, only whether the bytes match what you expected. In practice an accidental single-bit flip during transfer, a truncated download, or a stray line-ending conversion all produce a completely different digest with overwhelming probability.
MD5 and SHA-1 stay available because release manifests, package indexes and legacy artifacts still reference them, and reproducing those values is a legitimate reason to compute them. Both have practical collision attacks against motivated adversaries, so they remain appropriate for detecting accidental corruption and inappropriate for anything adversarial — a checksum that an attacker can deliberately collide is not an integrity control.
How the file is read, and what that costs
The implementation calls `file.arrayBuffer()` and hands the entire result to `crypto.subtle.digest`, which is a one-shot API — Web Crypto has no streaming digest interface. Peak memory therefore tracks file size, and a multi-gigabyte disk image will throw a `RangeError` or kill the tab rather than hash. Note also that `crypto.subtle` only exists in a secure context: over plain `http://` on a non-localhost origin the whole tool is inert, which is a confusing failure if you are testing on a LAN address.
For files too large to hold in memory, the workable approaches are an incremental implementation such as `hash-wasm`, or verifying on the machine that already holds the reference digest. When comparing text files across platforms, remember that the hash covers raw bytes — a UTF-8 BOM, CRLF line endings, or a trailing newline all change the digest, which is the usual explanation for a checksum that —should— match and does not.
Integrity is not authenticity, and not malware detection
A checksum answers exactly one question: is this byte-identical to the value I was given? An attacker who controls the distribution point can publish a matching digest for a payload they modified, because the digest is not a signature. Closing that gap needs detached signatures — GPG, minisign, Sigstore — or a registry that signs what it serves, where the trust anchor is the key rather than the file.
Nor does a checksum say anything about whether the content is malicious. Malware has whatever checksum the vendor published, because the checksum describes the file rather than judging it. Detection is a different job: antivirus engines, YARA rules, sandbox detonation. Use this page to answer —did the transfer corrupt or did I get the file I meant to get— and nothing beyond that.
Frequently Asked Questions
How do I compute a file checksum?
Which hash algorithms are supported?
Is my data sent to a server?
Do I need an account or API key?
Can I use these tools offline?
All processing happens in your browser. No uploads, no tracking, no servers. Your API keys, configs, and private payloads stay private — 100% client-side.