Check a file hash
Verify a download with SHA-256, SHA-1 or SHA-384 — computed locally.
Processed in your browser. Nothing is uploaded.
How to check a file hash
- 1
Add a file. Drop any file onto the box above. Size is not a problem.
- 2
Hash it. The file is read in chunks and hashed by your browser, on your device.
- 3
Compare. Copy the result, or paste a published checksum to have it checked for you.
What a checksum tells you
A hash is a short fingerprint of a file’s exact bytes. Change one bit anywhere and the fingerprint changes completely. That makes it the standard way to confirm a download arrived intact and is the file the publisher actually published: compute the hash of what you downloaded, compare it to the one on the project’s site, and they either match or they do not.
Paste the published checksum into the compare field and each file is marked as a match or not, so you do not have to eyeball 64 hex characters.
Why hashing in the browser is the honest version
Plenty of sites offer to hash a file for you by uploading it, which defeats the purpose twice over: you have sent them the file, and you are now trusting their answer about its integrity. QuietFiles reads the file in fixed-size chunks straight from disk and hashes it with the Web Crypto API built into your browser. Large files stream through a chunk at a time rather than being loaded whole, so a multi-gigabyte ISO does not have to fit in memory.
Use SHA-256 unless something specifically requires otherwise. SHA-1 is here because older projects still publish it, but it is broken for security purposes and should not be trusted to prove a file has not been tampered with.
Questions
Which algorithm should I use?
SHA-256, unless the publisher specifies another. SHA-384 and SHA-512 are also secure. SHA-1 is included only for old projects that still publish it — it is no longer safe to rely on for verifying that a file has not been altered.
Can it handle very large files?
Yes. The file is read in chunks and hashed incrementally, so memory use stays flat regardless of size. A multi-gigabyte file works.
Is my file uploaded to hash it?
No, and that matters more here than almost anywhere: a hashing service that uploads is asking you to trust it about the very thing you are trying to verify. Hashing runs in your browser through the Web Crypto API.
The hashes do not match. What now?
Download the file again — an interrupted or truncated download is by far the most common cause. If it still does not match, do not run or open the file, and check you are comparing against the checksum for the right version and platform.