Verify a downloaded file's checksum
Compute a file's hash locally, compare it with the publisher's checksum, and understand which algorithm to trust.
- 1
Integrity verification compares two hashes: the one the publisher published (e.g. sha256sums.txt on the release page) and one you compute from the file you actually received. Both happen locally here — the file is not uploaded.
- 2 Hash Calculator →
Drop or paste the file content and select SHA-256 (the most widely published algorithm). The output is a 64-character hex digest.
- 3 Hash Compare →
Paste your computed digest and the publisher's digest. The comparison is case-insensitive for hex and reports an exact match or an early divergence.
- 4
Interpretation: any single-bit difference in the file produces a completely different digest — a match means the bytes are identical. If they differ, re-download before assuming tampering: truncated transfers are the most common cause. For authenticity (was it really published by the vendor?), a checksum alone is not enough — verify a GPG or sigstore signature over the checksum file.
Frequently asked questions
- Which algorithm should I use?
- SHA-256 is the default choice and is what most projects publish. MD5 and SHA-1 still appear in legacy checksum files; they are adequate for accidental-corruption detection but must not be relied on against deliberate tampering.
- Isn't hashing the same as signing?
- No. A hash detects changes; a signature proves who produced the data. Strong release processes publish signatures over the checksum file, letting you verify both integrity and authenticity.
Workflows that solve this
Learn more
Want to understand why?