What is a checksum?
A checksum (or cryptographic hash) is a fixed-size string derived from data using a mathematical algorithm. Even a tiny change to the input produces a completely different hash. This makes checksums ideal for verifying that a file or message hasn’t been altered.
Common algorithms include SHA-256, SHA-1, SHA-384, and SHA-512. SHA-256 is widely used for integrity verification because it’s strong and widely supported. SHA-1 is older and considered weak for security purposes, but you may still encounter it in legacy contexts.
Checksums are not encryption. They’re one-way: you can’t reconstruct the original data from the hash. They’re also not unique—different inputs can theoretically produce the same hash (a collision), but strong algorithms make this astronomically unlikely in practice.
How to verify file integrity
To verify a file, compute its checksum and compare it to the expected value provided by the source. Many software publishers list SHA-256 hashes on their download pages. If the hashes match, you can be confident the file is exactly what the publisher intended.
Mismatches usually mean the file was corrupted during download, or you downloaded the wrong file. In rare cases, it could indicate tampering. Always download from official sources and verify checksums when available.
For large files, computing the hash can take a few seconds. This tool runs entirely in your browser using the Web Crypto API, so your files never leave your device.
Choosing the right algorithm
SHA-256 is the default choice for most integrity checks. It’s fast, secure, and universally supported. Use SHA-256 unless you have a specific reason to choose otherwise.
SHA-512 produces a longer hash (128 hex characters) and may be slightly slower. It’s useful when you want a larger hash output, but for most purposes SHA-256 is sufficient.
SHA-384 is a truncated version of SHA-512 that produces a 96-character hash. It’s less common but available if needed.
SHA-1 should be avoided for new projects. It’s vulnerable to collision attacks and is being phased out. Use it only if you must interoperate with legacy systems that still require SHA-1.
Browser-based hashing
Modern browsers include the Web Crypto API, which provides fast, secure cryptographic operations. This tool uses that API to compute hashes directly in your browser. Your files and text never leave your device, ensuring privacy.
Performance varies by device and browser. For very large files (multiple gigabytes), you may experience delays. In most cases, hashing files up to a few hundred megabytes is perfectly fine.
If your browser doesn’t support the Web Crypto API, this tool will show an error. All modern browsers support it, but very old versions may not.
Frequently Asked Questions
What is a checksum used for?
A checksum (or cryptographic hash) is used to verify integrity. If you download a file and compute its SHA-256 hash, you can compare it to the publisher’s expected value. If they match, the file is extremely likely to be unmodified.
What’s the difference between SHA-256 and SHA-1?
SHA-256 is stronger and recommended for integrity verification. SHA-1 is considered weaker against collision attacks and should be avoided for security-sensitive uses, although it may still appear in legacy tooling.
Can I compute checksums in the browser safely?
Yes. This tool uses the Web Crypto API, so your file contents stay on your device. Nothing is uploaded to a server. However, performance can vary on very large files.
Why does the tool not offer MD5?
MD5 is fast but cryptographically broken. For integrity, SHA-256 is usually preferred. If you need MD5 for legacy systems, use the dedicated MD5 Generator tool.
What does it mean if checksums don’t match?
A mismatch usually means the file is different: incomplete download, corruption, wrong file, or tampering. Re-download the file from an official source and compare again.
Privacy and methodology
This tool runs entirely in your browser. It uses the Web Crypto API to compute SHA hashes. No data is sent to any server. The hash algorithm follows the official specifications for SHA-1, SHA-256, SHA-384, and SHA-512.