Free tool · works offline · no upload
Check a file's SHA-256 or MD5 hash
A download page often lists a long string of letters and numbers, called a checksum or hash. Choose the file, paste that string, and see straight away whether they match.
- 1Choose
- 2Read
- 3Hash
- 4Double-check
- 5Compare
The file is read in this page and never uploaded: apart from a cookie-free visit count, this page's security policy blocks it from sending anything.
How to use it
- Choose the file you downloaded, or drop it on the box.
- Paste the expected hash from the publisher's page. The tool works out the algorithm from its length.
- The tool reads the file in pieces and works out the hash. Large files show a progress bar.
- Where the file fits in memory, it works out each SHA hash a second time with your browser's own crypto, as a cross-check.
- Read the result: a match means you have exactly the file the publisher hashed.
What a hash is
A hash function turns any file, of any size, into a short fixed-length fingerprint. Change a single bit of the file and the fingerprint changes completely. Two different files practically never share a SHA-256 fingerprint. So if the hash of your copy equals the hash the publisher printed, your copy is identical to theirs.
You can try it on our own download. The Silo decrypt tool page lists the SHA-256 of the download beside the button. Download it, choose it here, paste the hash, and you should see a match.
Pasting a hash
Publishers write hashes in different ways, and the tool accepts most of them. You can paste:
- The hash on its own, in capitals or lower case.
- A line from a checksum file, such as the hash followed by the file name.
- The output of a terminal command, such as
SHA256(file.zip)= …. - A hash broken up with spaces or colons.
The tool picks the algorithm from the length: 32 characters is MD5, 40 is SHA-1, 64 is SHA-256 and 128 is SHA-512.
Checked twice
Hashing a large file in a browser means reading it in pieces, so the tool uses its own streaming SHA-256, SHA-1 and MD5 code. For files that fit in memory, it then hashes the whole file again with the browser’s built-in crypto and compares the two answers. If they ever disagreed, you’d be told instead of shown a wrong result.
Questions
What does it mean if the hashes don't match?
The file you have isn't byte for byte the one the publisher hashed. Usually the download was cut short or damaged. Rarely, it was tampered with. Either way, don't open it: download it again from the official page and check again.
Which algorithm should I use?
Whichever the publisher lists. If there's a choice, use SHA-256. MD5 and SHA-1 still catch accidental damage, but they're no longer trusted against deliberate tampering.
Is there a size limit?
SHA-256, SHA-1 and MD5 work on files of any size, because the file is read in pieces. SHA-512 and the double-check need the whole file in memory, so they're skipped for files over 512 MB.
Is my file uploaded?
No. The file is read by your browser inside this page. Apart from a cookie-free visit count, the page's security policy blocks it from sending anything, so it couldn't upload the file even if it tried.
Can a matching hash prove a file is safe?
It proves the file is the one the publisher hashed, not that the publisher is trustworthy. Get the hash from the publisher's own site, over a secure connection.