About File Checksum Calculator
This file checksum calculator hashes a file you choose, starting with SHA-256, and tells you whether it matches the checksum the publisher gave you. The file is read by your browser and never uploaded. It is free, needs no sign-up and runs in your browser, so nothing you enter is uploaded.
A checksum answers one question: is this file exactly the one the publisher made? Download pages for Linux images, installers and archives publish a hash next to the link. Pick the file here, paste that value into Compare with a known hash, and you get Match or No match. Case, spaces and a leading 0x are ignored, and a Base64 value works too.
SHA-256 is selected to begin with. You can switch to MD5, SHA-1, SHA-512, SHA-3 or CRC32 if the publisher used one of those. Match the algorithm to the one on the page, since an MD5 will never equal a SHA-256. The hash is calculated over the file bytes, so renaming a file does not change it, and changing one byte does.
The file is read into memory by your browser, so very large files, such as multi-gigabyte disk images, may be slow or may run out of memory on a small device. For those, a command-line tool such as sha256sum, or Get-FileHash in PowerShell, streams the file instead.
A matching checksum only proves the file equals what the page said. If an attacker controlled the page, they could change both. Where a publisher offers a signature, verify that as well.
How to use File Checksum Calculator
- Choose an algorithm from the row of buttons: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 or CRC32. SHA-256 is a good default.
- Choose Text and type or paste your input, or choose File and pick a file from your device. The hash updates as you type.
- Read the digest in the result box. Tick Uppercase for capital hex letters, or Base64 output to show the digest in Base64 instead of hex.
- For a keyed hash, tick HMAC with secret key and enter the key. The result is then labelled HMAC-SHA-256 (or whichever algorithm you chose).
- To verify a download or a value from documentation, paste the expected hash into Compare with a known hash. The tool says Match or No match.
- Use Copy to put the digest on your clipboard.
Features
- Nine algorithms: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and CRC32.
- Hashes text as UTF-8, so accented letters, other scripts and emoji hash the same way as on a server or in a command-line tool.
- Hashes a file you choose from your device. The file is read in your browser and never uploaded.
- HMAC with a secret key for every algorithm except CRC32, following RFC 2104.
- Hex output in lowercase or uppercase, or Base64 output.
- Compare with a known hash. Case, spaces and a leading 0x are ignored, and the expected value can be hex or Base64.
- SHA-1, SHA-256, SHA-384 and SHA-512 use the Web Crypto API in your browser, which is fast and well tested.
- A warning appears when you pick MD5, SHA-1 or CRC32, because they are not safe for security purposes.
- One-click copy of the result.
Worked examples
SHA-256 of a file that holds the text "hello" and a newline (6 bytes) gives 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
Create it with a text editor that adds a final newline. Without the newline the file hashes to 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
MD5 of the same 6-byte file gives b1946ac92492d2347c6235b4d2611184
SHA-256 of an empty file gives e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Privacy: how it works
- The text, the file and the HMAC key stay in your browser tab. Nothing is sent to Ulkaa or to any other server, which you can confirm in the Network tab of your browser developer tools.
- Because the work happens on your own device, large files are limited by your browser memory rather than by an upload limit.
Tips
- To verify a download, choose File, pick the downloaded file, and paste the publisher hash into the compare box. A match means the bytes are identical to what the publisher hashed.
- Hash the same text twice with a trailing space added once. Seeing two unrelated digests is the quickest way to understand the avalanche effect.
- A hash you found on the same page as the download only protects against corruption. It cannot protect you if the page itself was altered.
- HMAC takes the key as plain text. If your key is hex or Base64, decode it first, or the result will not match another system.
Frequently asked questions
Is it really free?
Yes. There is no price, no trial and no credit card. Ulkaa Tool does the work with your own device, so there is no server bill to pass on to you.
Do I need an account?
No. There is no sign-up and no login. Open the page and use it. An Ulkaa account is not needed for anything on this tool.
Does it run in my browser?
Yes. Your text and files are processed by code running in your browser tab, on your own device.
Is my data uploaded?
No. Your text and files are never sent to Ulkaa or to anyone else. You can check this yourself by watching the Network tab in your browser developer tools while you use the tool.
How do I verify a downloaded file?
Choose File, select the downloaded file, then paste the checksum from the publisher into the compare box. Make sure the algorithm button matches the one the publisher used. A Match result means the file is identical.
Is the file uploaded to check it?
No. Your browser reads the file from your device and computes the hash locally. You can check this in the Network tab of your developer tools.
Is there a file size limit?
There is no upload limit, since nothing is uploaded. The whole file is loaded into browser memory, so the practical limit depends on your device. Use a command-line tool for very large files.
What does No match mean?
The file differs from what was hashed by the publisher, or you chose a different algorithm. Try the other algorithm first, then download the file again. A different file, a truncated download and a modified file all give No match.
More Hash Generator pages
- Hash GeneratorHash text or a file with MD5, SHA-1, SHA-2, SHA-3 or CRC32, add an HMAC key, and check the result against a known hash.
- MD5 Hash GeneratorGet the 128-bit MD5 hash of text or a file as 32 hexadecimal characters.
- SHA-1 Hash GeneratorGet the 160-bit SHA-1 hash of text or a file as 40 hexadecimal characters.
- SHA-224 Hash GeneratorGet the 224-bit SHA-224 hash of text or a file as 56 hexadecimal characters.
- SHA-256 Hash GeneratorGet the 256-bit SHA-256 hash of text or a file as 64 hexadecimal characters.
- SHA-384 Hash GeneratorGet the 384-bit SHA-384 hash of text or a file as 96 hexadecimal characters.
- SHA-512 Hash GeneratorGet the 512-bit SHA-512 hash of text or a file as 128 hexadecimal characters.
- SHA3-256 Hash GeneratorGet the 256-bit SHA3-256 hash of text or a file as 64 hexadecimal characters.
- SHA3-512 Hash GeneratorGet the 512-bit SHA3-512 hash of text or a file as 128 hexadecimal characters.
- CRC32 Checksum CalculatorCalculate the 32-bit CRC32 checksum of text or a file as 8 hexadecimal characters.
- HMAC-SHA256 GeneratorSign a message with a secret key using HMAC-SHA256 and read the result as hex or Base64.