File Hash Checker

How to use it

1. Drop a file onto the box, or press Choose file. Hashing starts straight away.
2. Tick the algorithms you need. SHA-256 is ticked by default because it’s what most download pages use.
3. To verify a download, paste the publisher’s checksum into Expected checksum. The tool recognises the algorithm from its length and ticks it for you.
4. You’ll see Match in green if the file is identical, or No match in red if it isn’t. Each hash has a Copy button.
5. To hash a piece of text instead, switch to the Text tab.

If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi

What is a file hash?

A hash, or checksum, is a short fingerprint calculated from every byte of a file. Change a single byte, even one letter in a document, and the fingerprint changes completely. Two different files having the same SHA-256 hash by accident is so unlikely that, in practice, a matching hash means the files are identical.

Software makers such as Linux distributions, password managers, crypto wallets and open-source projects publish the hash of each download. After downloading, you calculate the hash yourself and compare. If they match, the file arrived complete and hasn’t been swapped or altered. If they don’t, the download was corrupted, you have the wrong version, or someone has tampered with it.

Which algorithm should I use?

• SHA-256: the standard choice today. Use it whenever it’s offered.
• SHA-384 and SHA-512: longer members of the same family, used by some projects and for website Subresource Integrity (SRI) values.
• SHA-1: still shown on older download pages. Fine for spotting accidental corruption, but researchers can create two different files with the same SHA-1, so don’t rely on it against a determined attacker.
• MD5: very old and broken for security, but still common for checking that large files copied correctly. We label MD5 and SHA-1 “not collision-safe” as a reminder.

Pasting checksums in any format

You can paste a bare hash, an upper-case hash with colons between bytes, a line from a SHA256SUMS file (“hash filename”), the output of openssl dgst or certutil, or an SRI value such as sha384-…. Spaces, capitals and prefixes like “SHA256:” are ignored.

Big files

Files are read in 4 MB pieces, so even multi-gigabyte ISOs and backups can be checked without filling your computer’s memory. Files up to 256 MB use your browser’s built-in Web Crypto for the SHA family, which is very fast. Larger files are streamed through the tool’s own hashing code with a progress bar and a Cancel button. As a rough guide, a modern laptop hashes SHA-256 at around 100 MB per second this way. Phones are slower.

Privacy

Your file never leaves your device. The browser reads it locally and the hashes are calculated with JavaScript and Web Crypto on your own computer. Nothing is uploaded, stored or sent to Catpool or anyone else, so it’s safe to use with private documents, backups and work files. You can even disconnect from the internet after the page loads and it will still work.

Frequently asked questions

The hash doesn’t match. What should I do?

First make sure you’re comparing the same algorithm and the right file version, since publishers list a different hash for each version and platform. Then delete the file and download it again from the official site, not a mirror or a link in an email. If it still doesn’t match, don’t open or install it, and consider letting the publisher know.

Where do I find the expected checksum?

On the official download page, often labelled “SHA-256”, “checksum”, “hash” or in a file called SHA256SUMS next to the download. Get the checksum from the official website over HTTPS, not from the same place you got a suspicious file.

Why does my text give a different hash from another tool?

Hashes depend on every byte. A trailing new line, Windows line endings or a different text encoding all change the result. The Text tab hashes exactly what’s in the box, encoded as UTF-8.

Can a hash be reversed to get the file back?

No. A hash is a one-way fingerprint. It can confirm a file matches, but it can’t recreate the file.

Related: Catpool home, Security, Text Encrypt and Decrypt, Photo X-Ray, Website X-Ray.