What is File Checksum Compare?

A checksum compare hashes two files, or one file against a checksum you paste in, and tells you whether they match. It's the standard way to verify a download wasn't corrupted or tampered with. Files are hashed on your device and never leave it.

Two modes: file against file, or file against a checksum you paste in. A pasted value can arrive in almost any shape, from a bare digest to a sha256sum line with the filename attached or the BSD SHA256 (file) = form, and the algorithm is read off the digest length. Files up to 2 GB are hashed with a progress bar.

How to use

1. Drop in the first file, or paste an expected checksum string from a download page.
2. Drop in the second file and pick the algorithm: MD5, SHA-1, SHA-256, SHA-384, or SHA-512.
3. Read the verdict: a green match means the files are identical, a mismatch shows exactly where the hashes differ.

When to use

• Checking a downloaded ISO or installer against the hash on the release page.
• Confirming a file survived a transfer over USB, FTP or a flaky network share.
• Proving two backups of the same folder still hold identical copies.

Result

After downloading a Linux ISO, paste the SHA-256 string from the distro's website, drop in the downloaded ISO, and get a green "Match" — proof the 3 GB download arrived intact.

FAQ

The checksums do not match. Does that mean the file was tampered with?

Usually it means a truncated or corrupted download, which is far more common than an attack. Redownload and compare again. If a fresh copy still fails against the published hash, stop and get the file from another mirror.

Do I need to know which algorithm the publisher used before pasting?

No. A 32-character digest is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384 and 128 is SHA-512, so the algorithm is set from the length of what you paste. You can still override it if a publisher lists several.

Can I paste the whole line from a SHASUMS file instead of just the hash?

Yes. Labels, asterisks, filenames and surrounding brackets are stripped, and a digest broken across several lines by a narrow table gets reassembled. Whatever hex string is left at the right length becomes the value to compare.

Are MD5 and SHA-1 still good enough for checking that a download arrived intact?

For accidental corruption, yes, and plenty of older mirrors publish nothing else, which is why both are offered here. For proving a file was not deliberately swapped, use SHA-256: MD5 collisions have been cheap to make since 2008, and SHA-1 collisions have been produced in practice since 2017.

Why does comparing stop at 2 GB when my disk image is larger?

The digest routine needs the whole file in one block of memory, and a single allocation cannot go much past 2 GB. For bigger images, run sha256sum or certutil on the command line and paste the result in instead.

Related Tools