How to Verify a File Checksum (MD5, SHA-1 & SHA-256)
Download pages list long strings of hex digits next to their files — MD5, SHA-1, SHA-256 — and most people scroll right past them. Those strings are checksums, and verifying them is one of the quickest security habits you can build. Here's what they mean, which algorithm to use, and how to check a file in seconds without uploading it anywhere.
What Is a Checksum, Really?
A checksum is a short, fixed-length fingerprint of a file's exact contents. Feed any file through a hashing algorithm and you get a string of hex digits — the hash. Change one byte in the file and the hash changes completely. There's no way to reconstruct the file from its hash, and no two different files should share one.
Software publishers compute the hash of the file they ship and publish it on the download page. When you download the file, you compute its hash and compare. If they match, the file is byte-for-byte identical to what the publisher shipped. If they don't, the file is corrupted — or was modified somewhere along the way.
This catches two very different problems: accidental corruption (an interrupted download, a flaky USB stick) and deliberate tampering (a compromised mirror serving a modified installer). For the second case, use a modern algorithm — SHA-256 or SHA-512.
MD5 vs SHA-1 vs SHA-256: Which to Use
| Algorithm | Length | Status | Good for |
|---|---|---|---|
MD5 |
32 hex chars | Broken for security | Accidental corruption checks; legacy published hashes |
SHA-1 |
40 hex chars | Weak, being phased out | Older software that still publishes it |
SHA-256 |
64 hex chars | Current standard | Recommended for integrity checks today |
SHA-512 |
128 hex chars | Strong | Used by many Linux distros for ISOs |
The rule of thumb: use SHA-256 when the publisher offers it. If they only publish MD5 or SHA-1, use that — a matching hash still proves integrity against accidental corruption. Just don't rely on MD5 or SHA-1 alone against a determined attacker.
How to Verify a File in the Browser
- 1 Find the official checksum. On the download page, look for a line like
SHA-256:followed by 64 hex characters. Copy it. - 2 Drop the file into the calculator. Drag and drop the downloaded file into a client-side checksum tool. MD5, SHA-1, SHA-256, SHA-384, and SHA-512 compute in seconds.
- 3 Paste the checksum and compare. Paste the official value into the Verify field. The matching algorithm highlights green with a ✓ MATCH badge — or you get a clear no-match warning.
The comparison is case-insensitive, so uppercase or lowercase both work. If you're verifying an ISO, the same steps apply — distros like Ubuntu and Debian publish SHA-256 checksums precisely for this.
Why Verifying Should Happen on Your Device
- Upload-based hash sites. They ask you to upload the very file you're checking — to a third-party server. For a security task, that's a lot of unnecessary trust.
- Installing extra tools. Command-line hashing works, but installing software to check software is heavy for a one-off verification.
- Client-side calculators. Files are read with the File API and hashed in your browser — SHA via the native Web Crypto API, MD5 via local JavaScript. Nothing leaves your machine.
- Zero footprint. No account, no install, no upload, no size limits — and the file is gone when you close the tab.
Hashing a file is a privacy-sensitive task by nature: the file you're checking might be an unreleased build, a personal backup, or something you'd rather not share. Doing it locally keeps the check private from start to finish.
Frequently Asked Questions
What is a file checksum and why does it matter?
A checksum (or hash) is a short fixed-length fingerprint computed from a file's exact contents. Any change to the file — even a single bit — produces a completely different checksum. Software publishers publish checksums so you can confirm the file you downloaded is exactly what they shipped, catching corruption and tampering.
Which algorithm should I use: MD5, SHA-1, or SHA-256?
Use SHA-256 whenever possible — it's the modern standard for integrity checks. SHA-512 is a strong alternative used by many Linux distros. MD5 and SHA-1 are still published by older software and are fine for detecting accidental corruption, but they're no longer considered cryptographically secure, so don't rely on them against deliberate tampering.
How do I verify a file's checksum in the browser?
Drop the file into a checksum calculator like Prescosoft's, wait for the hashes to compute, then paste the official checksum from the download page into the Verify field. The tool compares it case-insensitively against MD5, SHA-1, SHA-256, SHA-384, and SHA-512 and highlights the matching algorithm with a green check — or tells you nothing matches.
Is it safe to hash a file on a website?
Only if the site processes the file locally. Prescosoft's calculator reads files with the File API and computes SHA hashes with your browser's native Web Crypto API — nothing is uploaded. Avoid sites that require uploading the very file you're trying to verify, since that defeats the purpose of a security check.
What if my checksum doesn't match?
A mismatch means the file differs from what the publisher shipped — it may be corrupted (an interrupted download) or modified. Redownload from the official source and verify again. If the checksum still doesn't match, treat the file as suspicious and don't run it.
Do checksums work for any file type?
Yes. Checksums are computed over raw bytes, so they work identically for executables, archives, images, documents, ISOs, and text files. The same file always produces the same hash, on any operating system.
Verify any file — privately
MD5, SHA-1, SHA-256, SHA-384, and SHA-512 in your browser. Nothing is uploaded.