Use this free online Checksum Calculator directly in your browser. No signup required, no data leaves your device. Part of Utilier — a collection of 133+ developer utilities.
What is Checksum Generator & Verifier (MD5, SHA-1, SHA-256, CRC32)?
Checksum generator creates cryptographic hashes of files or text to verify integrity and detect tampering. Upload file or paste text → tool calculates checksums using MD5, SHA-1, SHA-256, SHA-512, and CRC32 algorithms. Checksums are unique fingerprints: same file = same hash, even 1-bit change = completely different hash. Use to verify downloads (compare checksum with official source), detect file corruption (re-calculate after transfer), or ensure data integrity (database backups, archives). SHA-256 and SHA-512 are cryptographically secure (collision-resistant), MD5 and SHA-1 are deprecated for security but still used for non-security purposes (file identification). CRC32 is fast but weak (used for error detection, not security).
File and text hashing: Upload files (any size: documents, images, ISOs, archives) or paste text. Tool calculates all checksums simultaneously.
Verify integrity: Compare generated checksum with official source (e.g., Linux ISO SHA-256 from website). Match = file is authentic and uncorrupted. Mismatch = corrupted or tampered.
Detect tampering: Even 1-bit change (malware injection, corruption) produces completely different hash. Detects malicious modifications or accidental corruption.
Download verification: Verify downloads from mirrors or torrents. Example: Ubuntu ISO SHA-256 from official site → compare with downloaded file's SHA-256. Match = safe to install.
Why use checksum?
Verifying file integrity manually is difficult (compare billions of bytes?). Checksums provide instant cryptographic proof of authenticity.
Verify downloads are uncorrupted: Network errors, incomplete downloads, or disk errors can corrupt files. Calculate checksum → compare with official → ensures file is complete and uncorrupted.
Detect malware or tampering: Attackers inject malware into software downloads (supply chain attacks). Official SHA-256 ≠ downloaded SHA-256 = file was tampered. Don't install.
Ensure backup integrity: After backup or file transfer, verify data wasn't corrupted. Calculate checksum before and after → compare. Match = successful transfer.
File deduplication: Identify duplicate files (same content, different names). Same MD5/SHA-256 = same content. Cloud storage uses this to save space (dedupe).
Digital forensics: Prove file hasn't been modified (chain of custody). Calculate SHA-256 at collection → re-calculate at trial → match = evidence is unchanged.
Git and version control: Git uses SHA-1 hashes to identify commits and files. Ensures repository integrity (detect corruption or tampering).
When to use checksum
Use whenever you need to verify file authenticity, integrity, or detect tampering.
Verifying downloaded software (Linux ISOs, Docker images, firmware updates) against official checksums.
Detecting file corruption after download, transfer, or backup (compare checksum before/after).
Ensuring data integrity in databases or archives (calculate periodic checksums, verify no corruption).
Identifying duplicate files (same SHA-256 = same content, even if different names/locations).
Digital forensics or legal evidence (prove file hasn't been modified since collection).
Software distribution (publish SHA-256 alongside downloads for users to verify).
Learning cryptographic hashing (see how SHA-256 works, avalanche effect).
How to use checksum
Upload file or paste text, view checksums.
Upload file or paste text: Upload any file (document, image, ISO, archive, executable) or paste text. Tool supports large files (GB+).
Compare with official checksum: Copy SHA-256 from official source (website, README). Paste or compare with generated checksum. Match = file is authentic. Mismatch = corrupted or tampered.
Copy checksum: Click Copy to clipboard. Use in documentation, verification scripts, or publish alongside downloads.
Re-verify (optional): After file transfer or backup, re-calculate checksum. Compare with original. Match = successful transfer, no corruption.
Choose algorithm: SHA-256 or SHA-512 for security (tamper detection). MD5 for legacy/compatibility (file identification). CRC32 for error detection (not security).
Key features
Multiple algorithms: MD5, SHA-1, SHA-256, SHA-512, CRC32. All calculated simultaneously for comparison.
File and text input: Upload files (any size, any type) or paste text. Supports large files (GB+).
Instant verification: Compare generated checksum with official source. Visual match/mismatch indicator.
Copy to clipboard: Copy any checksum (MD5, SHA-256, etc.) for documentation or scripts.
Security warnings: Tool warns when using deprecated algorithms (MD5, SHA-1) for security purposes. Recommends SHA-256/SHA-512.
Offline support: Tool runs locally (no file upload to server). Privacy-safe for sensitive files.
Common use cases
Verify Linux ISO download: Ubuntu.iso downloaded from mirror. Official SHA-256: abc123.... Generate SHA-256 from downloaded file. Match = safe to install. Mismatch = re-download.
Detect file corruption: Backup file to external drive. Calculate SHA-256 before backup: abc123. After backup, re-calculate: abc123. Match = successful backup. Mismatch = corruption (bad drive?).
Identify duplicate files: photo.jpg and image.jpg have same SHA-256 = same content (exact duplicates). Delete duplicate to save space. Cloud storage uses this for deduplication.
Git commit verification: Git uses SHA-1 for commit IDs. Commit abc123 = SHA-1 hash of commit content. Ensures commit wasn't tampered (though SHA-1 is deprecated for security).
Digital forensics: Collect evidence file. Calculate SHA-256: abc123. Store in chain of custody. At trial, re-calculate: abc123. Match = evidence unchanged (admissible in court).
Even empty file has hash (hash of zero-length input). Same for all empty files.
Technical reference
Checksum algorithm specifications:
MD5 (Message Digest 5)
128-bit hash (32 hex chars). Example: 098f6bcd4621d373cade4e832627b4f6 (MD5 of 'test'). DEPRECATED for security (collisions found in 2004). Still used for file identification (non-security).
SHA-1 (Secure Hash Algorithm 1)
160-bit hash (40 hex chars). Example: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 (SHA-1 of 'test'). DEPRECATED (collisions since 2017, SHAttered attack). Git uses SHA-1 (migration to SHA-256).
SHA-256 (SHA-2 family)
256-bit hash (64 hex chars). Example: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 (SHA-256 of 'test'). SECURE (no known collisions). Recommended for security.
SHA-512 (SHA-2 family)
512-bit hash (128 hex chars). More secure than SHA-256 (larger hash = more collision-resistant). Slower to compute but higher security. Used for high-security applications.
CRC32 (Cyclic Redundancy Check)
32-bit checksum (8 hex chars). Example: 0c7e7fd8 (CRC32 of 'test'). WEAK (not cryptographically secure, easy to forge). Used for error detection (ZIP, PNG), NOT security.
Avalanche effect
1-bit change in input → ~50% of output bits change. Example: SHA-256('test') vs SHA-256('Test') = completely different. Detects even tiny modifications.
Collision resistance
Hard to find two different inputs with same hash. SHA-256: 2^256 possible hashes (practically impossible to collide). MD5: collisions found (not secure).
Deterministic
Same input always produces same hash. 'hello' → same SHA-256 every time. No randomness (unlike salted passwords).
One-way function
Can't reverse hash to get original data. SHA-256('password') = abc123, but can't calculate password from abc123 (except brute force).
Using MD5 or SHA-1 for security (tamper detection, signatures), despite deprecation
Why it happens: MD5 has known collisions (2004, can create two different files with same MD5). SHA-1 collisions since 2017 (SHAttered attack). Attackers can forge files with same hash. Not secure for tamper detection.
How to avoid it: Use SHA-256 or SHA-512 for security. MD5/SHA-1 are OK for non-security use cases (file identification, deduplication). Tool should warn when using deprecated algorithms for security.
Not verifying checksums after download (trusting file is uncorrupted)
Why it happens: Network errors, incomplete downloads, or disk errors can corrupt files. Installing corrupted software = crashes, data loss, or security vulnerabilities. Malicious mirrors inject malware (supply chain attacks).
How to avoid it: Always verify SHA-256 from official source. Don't install software without verifying checksum. Example: Ubuntu ISO → get official SHA-256 from ubuntu.com → compare with downloaded file.
Comparing checksums manually (typos cause false mismatch)
Why it happens: SHA-256 is 64 hex characters. Manual comparison is error-prone (typos, similar characters: O vs 0, l vs 1). False mismatch = re-download unnecessarily. False match = corrupted file installed.
How to avoid it: Use tool to compare: paste official SHA-256 → tool highlights match/mismatch. Or use command: echo 'abc123 file.iso' | sha256sum -c (Linux/Mac). Avoids manual typos.
Using CRC32 for tamper detection or security
Why it happens: CRC32 is weak (32-bit, easy to forge). Designed for error detection (accidental corruption), not security (intentional tampering). Attacker can modify file and adjust to keep same CRC32.
How to avoid it: Use CRC32 only for error detection (ZIP, PNG file integrity). For security, use SHA-256 (256-bit, collision-resistant). CRC32 for accidents, SHA-256 for attacks.
Not re-calculating checksum after file transfer (assuming transfer was successful)
Why it happens: File transfer can fail silently (network errors, partial writes, disk errors). File appears complete but is corrupted. Example: backup to external drive → drive has bad sectors → partial write.
How to avoid it: Calculate checksum before transfer → re-calculate after transfer → compare. Match = successful transfer. Mismatch = re-transfer or investigate. Critical for backups, archives.
Frequently asked questions
What is the difference between MD5, SHA-1, and SHA-256?
MD5 (128-bit, deprecated, collisions). SHA-1 (160-bit, deprecated, collisions since 2017). SHA-256 (256-bit, secure, no known collisions). Use SHA-256 for security.
Why is my checksum different from the official one?
File is corrupted (incomplete download, network error) or tampered (malware injection). Re-download from official source. DO NOT use file with mismatched checksum.
Can I use MD5 or SHA-1?
For non-security use (file identification, deduplication): yes. For security (tamper detection, signatures): NO (use SHA-256/SHA-512). MD5/SHA-1 have known collisions.
What is CRC32 used for?
Error detection (accidental corruption), not security. Used in ZIP, PNG, Ethernet. Fast but weak (32-bit, easy to forge). Don't use for tamper detection.
How do I verify a download with checksum?
Get official SHA-256 from source (website, README). Download file → generate SHA-256 → compare. Match = safe. Mismatch = corrupted or tampered (re-download).
What is a collision in hashing?
Two different inputs producing same hash. Example: MD5(file1) = MD5(file2) but file1 ≠ file2. SHA-256 has no known collisions (2^256 possible hashes).
Can I reverse a hash to get the original data?
No (one-way function). SHA-256('password') = abc123, but can't calculate password from abc123 (except brute force). That's why hashes are used for passwords.