Kit-Bin
Donate

File Hash Checker

Calculate or verify an MD5, SHA-1, SHA-256, or SHA-512 checksum. Your file never leaves this browser.

Processed entirely in your browser. Never uploaded to a server.

Or drop any file here. It is read locally to calculate its checksum.

A file hash is a fingerprint calculated from every byte in a file. Use it to compare a download with the checksum published by its creator, to check a file wasn't corrupted or tampered with in transit, or to record an exact version of a file before sharing it. Pick the algorithm that matches whatever value you're checking against, or SHA-256 by default if you're just creating one from scratch.

How to verify a downloaded file

  1. Find the published hash value and algorithm from the vendor's official download page or signed release notes.
  2. Select that same algorithm above.
  3. Select the downloaded file here.
  4. Paste the published value into "Expected hash" and check the match result, or compare the two values yourself if you'd rather.
  5. If they don't match, do not assume the download is the expected file.

What this does not prove

A hash can check equality. It cannot prove that a file is safe, identify who created it, or replace a trusted signature. The expected hash must come from a source you already trust.

FAQ

Is my file uploaded to create the hash?
No. The browser reads the selected file and calculates the digest locally, with whichever algorithm you pick. The file contents are not sent to Kit-Bin.
What is a file hash used for?
A hash is a fixed fingerprint calculated from every byte in a file. Compare it with the value published by a software vendor, or paste it into the "Expected hash" field here, to check that a downloaded file has not changed.
How do I verify a file against a hash someone published?
Pick the same algorithm they used (the value length gives it away if unstated: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, 128 is SHA-512), select your file, and paste their value into "Expected hash". This tool compares it against what it computes and tells you immediately whether they match.
Which algorithm should I use?
Use whichever one the source already published a hash for — matching their algorithm is what matters, not which is "better". If you're creating a hash from scratch with no existing value to match, SHA-256 is the modern default; MD5 and SHA-1 are still common on older release pages but are cryptographically broken for security purposes (fine for accidental-corruption checks, not for tamper detection).
Does a matching hash prove a file is safe?
No. It only proves that the bytes match the file used to create the expected hash. Get the expected value from a source you trust.
Can I hash a large file?
Usually, yes, but the full file must fit in browser memory to be processed. Very large files can be slow or exceed a mobile browser’s memory limit.
Are these hashes case-sensitive?
The hash itself is not case-sensitive as a value — hex digits a-f and A-F represent the same bits — but comparing two hashes as plain text requires matching case or lowercasing both first. This tool always outputs lowercase hex and compares the "Expected hash" field case-insensitively, so pasting a value in either case works.

Need to compare structured configuration instead? Use JSON Diff.

What does a matching SHA-256 hash actually prove? Read what a SHA-256 hash proves (and what it doesn't).