Skip to content
XUtilHub

File Hash Checker – MD5, SHA-1, SHA-256 & SHA-512 Checksums

Calculate MD5, SHA-1, SHA-256 and SHA-512 checksums of any file and compare with the expected hash to verify downloads. Files stay on your device.

  • Free, no sign-up
  • Runs in your browser, nothing uploaded

About the File Hash Checker

Verify that a download is genuine and undamaged: get the MD5, SHA-1, SHA-256 and SHA-512 hashes of any file, of any size, and compare them with the checksum published by the provider.

Key features

  • MD5, SHA-1, SHA-256 and SHA-512 at once
  • Files of any size, read in chunks
  • Compare with an expected checksum
  • Clear match or no-match result
  • Copy any hash
  • Files never leave your device

Verify downloads and files

Drop a file to calculate its checksums, then paste the hash from the download page. If they match, your copy is identical to the original, byte for byte.

Known example

The text hello world (11 bytes, no newline) has these hashes:

AlgorithmHash
MD55eb63bbbe01eeed093cb22bb8f5acdc3
SHA-12aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA-256b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9

Hash algorithms compared

AlgorithmLengthSecurity today
MD5128 bits (32 hex)Broken for security; OK for spotting corruption
SHA-1160 bits (40 hex)Broken for security; OK for spotting corruption
SHA-256256 bits (64 hex)Secure, the most widely used
SHA-512512 bits (128 hex)Secure

Hash generator for text, bcrypt generator, and text encryption.

How to use the File Hash Checker

  1. Drop a file onto the box, or click to choose one.
  2. MD5, SHA-1, SHA-256 and SHA-512 hashes are calculated in your browser.
  3. Paste the checksum from the download page to compare.
  4. A green match means the file is exactly the original.

Frequently asked questions

Why verify a file's hash?

To make sure a download is exactly what the publisher released: not corrupted during download and not tampered with. Software sites often publish SHA-256 checksums for this purpose.

Which hash should I use?

SHA-256 or SHA-512. MD5 and SHA-1 are still fine for detecting accidental corruption, but they're no longer secure against deliberate tampering.

Is my file uploaded?

No. The file is read and hashed in your browser in 4 MB pieces, so even very large files work without being sent anywhere.

Does the case of the hash matter?

No. Hex hashes are compared without regard to upper or lower case.

Are my passwords and files sent to your servers?

No. All checks, hashing and encryption run in your browser using its built-in Web Crypto features. The only network request is the optional breach check, which sends just the first 5 characters of your password's SHA-1 hash, never the password.

Can I trust browser-based security tools?

These tools use the same standard algorithms (AES-GCM, PBKDF2, SHA-2, HMAC) built into your browser. Still, never type the passwords or 2FA secrets of important accounts into any website you don't control.

Do the tools work offline?

Yes. Once a page has loaded, everything except the breach check works without a connection.

Last updated:

Related Security tools