2026-10-15 · 2 min read
Check a download with a file checksum
Hash the file you downloaded, then compare that hex digest with the line the publisher posted.
Key takeaways
- Select the algorithm printed next to the file. The page opens on MD5, not SHA-256.
- A matching digest means those bytes match that hash. It does not prove who published the file.
Workflow
Download the artifact and copy the publisher's checksum line. Open File Checksum, upload that same file, and select MD5, SHA-1, or SHA-256 so the button matches the line. The first button is MD5, so switch before you run when the notice says SHA-256.
Compare the hex yourself. Ignore spaces and letter case. If the digest differs, stop and download again. Do not edit the file to make the hash match.
Limits
The upload cap is 20 MB. Larger installers need a local checksum command. Each run returns one algorithm, not MD5, SHA-1, and SHA-256 together.
MD5 and SHA-1 still catch a truncated download. They are a weak choice when you care about collision resistance. Prefer SHA-256 when the publisher offers it.
What this tool does not do
It does not check an OpenPGP or minisign signature, and it does not fetch the published digest for you.
It does not compute SHA-512. Hash Generator does SHA-512 for text. HMAC Generator is a keyed MAC, which is a different check from a published file digest.
FAQ
Why does the result include a size?
The output prints the algorithm, the hex digest, and the byte length of the buffer that was hashed. Compare the digest. The size is a quick check that the whole file was read.
Can I paste a short string instead of a file?
This tool hashes an uploaded file. For a text digest, use Hash Generator, which covers SHA-1, SHA-256, and SHA-512 and does not read a file.