How to check file checksums in the browser

Choose one or more files and the page reads each one and computes a SHA-2 digest with the browser’s Web Crypto API. The table lists the file name, its size, the digest and whether it matches the value you entered. The bytes never leave the device.

A digest is a fingerprint of fixed length for the exact file contents, so a checksum answers the question every download page raises: did this file arrive unchanged?

  1. Add one or more files with the drop zone or the file picker. The list shows every name and size.
  2. Pick the algorithm: SHA-256, SHA-384 or SHA-512.
  3. If the publisher gives a digest, paste it into "Expected hash (optional)"; a whole line copied from sha256sum or openssl is accepted too.
  4. Press "Calculate hashes". The files are hashed one after another and the status line tracks them ("Hashing 2 of 3…").
  5. Read the Verification column - Match, Mismatch or Not checked - then take the result out with "Copy manifest" or "Download manifest".

What is hashed, how the expected value is compared, and what the manifest contains

Which digests are produced

SHA-256, SHA-384 and SHA-512 are the three options, with SHA-256 as the default. Every digest is computed over the raw bytes of the file and written in hexadecimal with 64, 96 or 128 characters. In the probe all three algorithms returned exactly the same values as Node’s crypto module for the same files.

A file with no content hashes to a fixed value (e3b0c442…b855 under SHA-256), and names with spaces or accents such as "Café Müller.txt" are handled as they are.

How the expected value is compared

The expected box takes a bare digest in any mix of upper and lower case, and also a whole line as checksum files carry it: the first hexadecimal token of 32 characters or more is compared, so "b6a98d… alpha.txt" is read as the digest itself.

Only the first selected file is compared; the remaining rows stay Not checked. Editing the expected value after a run re-checks the digest already on screen, without reading the files again.

Stale results, Clear and limits

Digests are dropped as soon as they would no longer describe what is on screen: adding files after a run, choosing another algorithm or pressing Clear empties the table and the manifest buttons, so an old digest is never shown next to a new selection.

Clear also empties the expected box and returns the algorithm to SHA-256. One run processes up to 250 MB of files; anything larger is refused with its own message. Everything happens in the page and keeps working offline once loaded.

Recent tools: