How to check a download is genuine with a SHA-256 hash
2 min read
A publisher lists a checksum next to a download. If the file you received hashes to the same value, the bytes are identical to what they published; if it does not, something changed the file — a corrupted transfer, a truncated download, or something worse. Checking takes ten seconds and is the difference between trusting a mirror and verifying it.
This tool computes SHA-1, SHA-256, SHA-384 and SHA-512 with the browser’s Web Crypto API on your own machine. Uploading a file to a website in order to check whether a download is trustworthy would be a strange thing to do; hashing locally avoids the question entirely.
Open tool →Hash generatorSHA-1, SHA-256, SHA-384 and SHA-512 digests of text or a file, computed locally.The steps
Verify a download’s checksum
- Find the published hashIt is usually on the download page or in a checksums file next to the release.
- Drop the downloaded fileThe tool hashes it where it sits, in your browser.
- Pick the same algorithmIf the publisher lists SHA-256, use SHA-256. A SHA-1 value will never match a SHA-256 one.
- Compare character by characterCase does not matter; every character does. Compare the last few characters first, where a truncated copy usually diverges.
- Act on the resultA match means the bytes are intact. No match means re-download from the official source before running anything.
Why SHA-256 rather than MD5
MD5 and SHA-1 are still common in older checksum files, and both are broken for security purposes: collisions can be constructed deliberately, so an attacker can produce a different file with the same digest. For verifying integrity against accident they still work. For verifying integrity against an adversary they do not. SHA-256 has no known practical collision.
The tool still offers SHA-1 because existing release pages publish it, and a value you cannot check is worse than one you can. Prefer SHA-256 for anything new.
What a matching hash does and does not prove
- It proves the bytes you have are the bytes the publisher hashed.
- It does not prove the publisher is trustworthy — if the checksum page itself was replaced, both are wrong together.
- It does not prove the file is safe to run, only that it is unmodified.
- It does not survive re-compression: a .zip re-zipped, or a file re-saved, will hash differently even if the content looks the same.
Get the checksum from a channel independent of the download where possible — a signed release note, a second device, or the project’s repository rather than a mirror.
Tools used in this guide
Questions about this guide
- Is it safe to hash a file on a website?
- Here it is, because the hashing happens in your browser using the Web Crypto API — there is no upload request. You can confirm it in the network panel.
- Can I hash a large file?
- Yes, subject to your device’s memory. Hashing reads the whole file into memory, so multi-gigabyte files on a phone can be slow.
- Why do two hashes of the same file differ?
- They should not. If they do, you are hashing different bytes — a different algorithm, a re-saved copy, or a truncated download.
- Should I use SHA-1 if the site lists it?
- For checking a download against accidental corruption, yes. For security against a deliberate substitution, no — prefer SHA-256.
All guides
- How to merge PDF files without uploading themCombine several PDFs into one document, in the order you choose, entirely in your browser. No upload, no account, no page limit.
- How to split a PDF: extract a page range or one file per pagePull out the pages you need from a PDF, or turn a document into one file per page — locally, without uploading it.
Written and maintained by the FreeOnlineBox project. Every tool named in this guide runs on the reader’s own device; no file described here is uploaded to check it.