01
Catches damaged or changed files
A single changed byte gives a completely different SHA-256. A match means the file wasn't corrupted in the download or swapped along the way.
Free tool · Runs in your browser
File checksum
checker.
Make sure a download is exactly what the publisher released. Drop in a file to get its SHA-256, SHA-1, SHA-384 and SHA-512 hashes, then paste the hash from the download page to compare. The file is read on your device and never uploaded.
Your file is read and hashed right here in your browser with the Web Crypto API. It is never uploaded, stored, or logged — not by Veteran Solutions, not by anyone.
Last updated
How it works
Check a download before you open it.
Publishers list a hash, a short fingerprint of the file. If your copy produces the same fingerprint, it's the same file, byte for byte.
02
Nothing uploaded
Your browser reads the file and hashes it with the Web Crypto API on this device. The file and its name never leave this page.
03
Instant compare
Paste the hash from the publisher's page, even with extra text around it. The tool picks out the hash, detects its type, and shows match or no match.
Step by step
How to verify a download.
- Download the file from the official site.
- Find the SHA-256 (sometimes called a checksum or hash) on the same official page, over HTTPS.
- Drop the file above and paste the published hash.
- Match: safe to open. No match: delete it and download it again from the official site.
Prefer the command line? These built-in commands give the same SHA-256:
| System | Command |
|---|---|
| Windows (PowerShell) | Get-FileHash .\file.iso |
| Windows (Command Prompt) | certutil -hashfile file.iso SHA256 |
| macOS | shasum -a 256 file.iso |
| Linux | sha256sum file.iso |
A matching hash proves your file is the one listed on that page. If the publisher also signs its releases (code signing or a PGP signature), checking the signature protects you even if the website itself were hacked.
FAQ
Common questions.
What is a checksum or hash?
It is a short fingerprint calculated from every byte of a file. SHA-256 gives a 64-character code; change even one byte and the code changes completely. Publishers list it so you can confirm your copy is identical to theirs.
Is my file uploaded?
No. Your browser reads the file into memory on your device and calculates the hashes with the Web Crypto API. Nothing about the file, including its name, is sent anywhere.
Which hash should I use?
SHA-256, which is what most publishers list. SHA-384 and SHA-512 are also strong. SHA-1 is shown for older download pages, but it's no longer safe against deliberate tampering. MD5 isn't offered because it's broken; if a site lists only MD5, ask for SHA-256.
It says no match. What now?
Don't open the file. Make sure you copied the hash for the same file and version, then download the file again from the official site. If it still doesn't match, contact the publisher.
How big a file can I check?
Up to 2 GB, depending on your device's memory. For larger files, such as some disk images, use the built-in command for your system listed above.
More free tools
See all free tools →
Veteran Solutions, LLC
Need help with your network?
Monitoring assessments, NOC runbooks, network administration, and hands-on hardware deployment from a service-disabled veteran-owned small business in Waco, Texas.