Inspect
File hash checker
A file hash, or checksum, is a short fingerprint of a file's exact contents. Get the SHA-256 of a download, installer, archive or document, check it against the one the publisher gave you, or see whether two files are identical.
Files are read piece by piece on your device, with progress and a Cancel button, so even multi-gigabyte downloads can be checked. Nothing is uploaded.
- Hashes matchYour file is byte for byte the same as the one the checksum was made from.
- Hashes differIt is a different file, or it was changed or damaged, for example by an interrupted download.
- What it cannot tellWho made the file, or whether it is safe. That depends on where the checksum came from.
Result
Checking photos? The Image Hash Checker does the same exact-byte check, set up for comparing pictures. A hash cannot tell whether two pictures look alike: for that, use the Duplicate Image Finder.
Upper or lower case and extra spaces do not matter. The algorithm is recognised from the length. A list with one “hash file name” per line also works.
Check that the checksum is for this exact file and version, and uses the same algorithm. If it is, download the file again from the official source; do not open a file that fails the check.
How to use it
Check a download in four steps
- Choose the file. Its SHA-256 is calculated on your device, with progress for large files. Copy it with one click.
- Paste the expected checksum from the publisher's download page. Upper or lower case and extra spaces do not matter, and the algorithm is recognised from the length: MD5, SHA-1, SHA-384 or SHA-512 are turned on when the checksum needs them.
- Read the verdict. Match means your copy is byte for byte the file the checksum was made from. No match means it is a different or damaged file: do not open it; download it again from the official source.
- Checking several files? Add them all, or open the
SHA256SUMSfile that came with them: each file is checked against its own line. Download the results as CSV or copy them as a checksum list.
Know the limits
What a checksum proves, and what it does not
How it works. The same bytes always give the same hash. Change one bit, or lose the last few kilobytes of a download, and the hash is completely different. Comparing your file's SHA-256 with the published one tells you whether your copy is complete and unchanged.
What it does not prove. A matching hash does not say who made the file or that it is safe. If someone can replace the file on a website, they may be able to replace the checksum next to it too. Take the checksum from the official source, over HTTPS, and where the publisher offers a signature (for example GPG), verify that as well.
Why MD5 and SHA-1 are only for older checksums. Researchers can make two different files with the same MD5 or SHA-1 on purpose. They still catch accidental damage, so they are offered to compare with checksums published that way, but use SHA-256 for anything new.
Which tool?
Files, photos and look-alike pictures
Use this tool for any file, especially downloads and large files. The Image Hash Checker runs the same exact-byte check for photos, for example to see which of several pictures are identical. Neither tool can tell whether two pictures look alike: a re-saved photo has a completely different hash. For look-alike photos, the Duplicate Image Finder compares what pictures look like.
FAQ
File hash questions.
What is a file hash or checksum?
A fixed-length fingerprint calculated from every byte of a file, such as a 64-character SHA-256. The same file always gives the same hash, and any change gives a completely different one. Publishers list it next to a download so you can confirm your copy is complete and unchanged.
How do I verify a SHA-256 checksum?
Choose the downloaded file, then paste the SHA-256 from the publisher's page into Expected checksum. The tool shows Match or No match. On the command line, the same value comes from sha256sum on Linux, shasum -a 256 on macOS and certutil -hashfile <file> SHA256 on Windows.
The checksum does not match. What should I do?
First check that the checksum is for this exact file and version and uses the same algorithm: a SHA-256 cannot match an MD5, and installers for different systems have different checksums. If it is the right one, the download is incomplete, damaged or not the original file. Delete it, do not open it, and download it again from the official source.
Does a matching checksum prove a file is safe or genuine?
No. It proves your file is identical to the file the checksum was made from. If that checksum came from an untrusted page, or the publisher's site was compromised, both could have been replaced. Get the checksum from the official source and, when a digital signature is offered, verify it too.
Why are MD5 and SHA-1 marked as not recommended?
Both are broken for security: different files with the same MD5 or SHA-1 can be made on purpose. They still detect accidental damage, so the tool can calculate them to compare with older published checksums, but it does not offer them by default. Use SHA-256 for new checksums.
Which algorithm should I choose?
The one the publisher used; paste their checksum and the tool turns it on for you. When you choose, SHA-256 is the standard. SHA-384 and SHA-512 are equally suitable and appear in some download pages and signatures.
Is there a file size limit?
There is no fixed limit. Files are read in 8 MB pieces, so memory use stays low, and files up to 128 MB use your browser's built-in SHA code for speed. It has been tested with a 4 GB file. Speed depends on your device: on the laptop it was tested on, SHA-256 ran at about 50 MB/s, so a 4 GB file took about 80 seconds. Phones are slower, and each extra algorithm adds time.
Can I check whether two files are identical?
Yes. Add both: the tool says whether they are identical, byte for byte, because identical files have the same SHA-256. File names, dates and folders are not part of the contents, so a renamed copy is still identical.
Are my files uploaded?
No. Files are read and hashed in your browser, in a background worker. Files, file names, checksums and lists are not sent anywhere, including analytics.