Hash & Checksum Verifier

Check downloads against their published checksum — and verify the checksum file’s own OpenPGP or minisign signature, so you know who published it.

Free · no sign-up · updated

Runs entirely in your browser. Nothing you enter leaves this page.

requests since opened: 0
Verify it yourself

This page is served with a security policy your browser enforces: it cannot open connections or load anything from other sites — not even to us.

  1. Open your browser’s developer tools (F12, or ⌥⌘I on Mac) → Network tab, then use the tool. No new requests appear.
  2. Or disconnect from the internet after the page loads — the tool keeps working, because it never needed the network.
  3. See the rule itself: in the Network tab, select this page’s document → Response Headers → content-security-policy contains connect-src 'none' and no 'unsafe-inline' for scripts.
  4. Press Test the lock: the page tries a harmless request and the browser blocks it (the Console shows the refusal).

tools v0.9.1 · build 0efa119

How to use
  1. Single file: drop it and paste the published checksum.
  2. Signed release: add the publisher’s key, the checksum list and its signature, then your downloads.
  3. Compare the key fingerprint shown with the one on the publisher’s website.

Drop a file here, or

Read in 4 MB pieces straight from your disk. Files over 1 GB work with MD5, SHA-1 and SHA-256.

Checks every algorithm against the published FIPS 180 / RFC 1321 answers, including 1,000,000 × “a”.

A checksum proves less than you think

A matching SHA-256 proves that your file is identical to the one the checksum was made from. It does not prove who made either: an attacker who can replace a download on a mirror can usually replace the checksum next to it. That is why projects sign their checksum list with OpenPGP or minisign, and why this tool verifies that signature as well.

The chain of trust for a release

Verifying a signed release has three links: the file matches its line in SHA256SUMS, SHA256SUMS carries a valid signature, and the signing key really belongs to the publisher. The first two are checked here. The third is yours: compare the key fingerprint shown with the one published on the project’s website, documentation or a source you already trust — once, and then keep the key.

Which algorithm to trust

SHA-256 and SHA-512 are the standard for downloads. MD5 and SHA-1 still catch accidental corruption, but both have practical collision attacks (SHA-1 since the 2017 SHAttered result), so a match does not rule out deliberate tampering. The algorithm is detected from the checksum’s length. Large files are hashed in pieces in your browser, so multi-gigabyte ISO images work without being uploaded anywhere.

Where to find the pieces: Ubuntu and Debian publish SHA256SUMS next to the image, with its signature as SHA256SUMS.gpg (Ubuntu) or SHA256SUMS.sign (Debian); projects that use minisign publish a .minisig file and a public key starting with RW.

Common questions

How do I verify a file’s SHA-256 checksum?

Drop the file and paste the checksum from the download page. The algorithm is detected from its length, and you get a clear match or mismatch. Large files are read in pieces, so multi-gigabyte ISOs work.

Is a matching checksum enough?

It proves the file matches the list, not that the list is genuine — an attacker who changes the download can change the checksum too. Verifying the list’s signature with the publisher’s key closes that gap.

Is my file uploaded?

No. Your browser reads the file from your disk, and the page cannot open any connection to send it.

Known limitations
  • You supply the publisher’s key — check its fingerprint at an official source.
  • OpenPGP v4 RSA and Ed25519 only; key expiry and revocation aren’t checked.
  • MD5 and SHA-1 catch corruption, not tampering. SHA-384/512 up to 1 GB.
  • Browser extensions can read any page — use a private window for sensitive data. How the lock works

Related reading on CipherMind

Standards & references