SHA-256 File Checker: Verify a Download in Your Browser
A SHA-256 checksum is a fingerprint of a file. If the fingerprint you compute matches the one the publisher lists, the file was not changed or corrupted on the way to you. Drop a file here to compute its SHA-256 in your browser, then paste the expected value to compare. Nothing is uploaded.
How it works, and why nothing is uploaded
The browser reads the file in pieces and feeds each piece to a SHA-256 routine on your device. Only the 64-character result is shown. For files up to 256 MB the page uses the browser's built-in crypto. For bigger files it uses its own streaming code so memory stays small.
When to use it
- After you download an installer, to confirm it matches the checksum on the publisher's page.
- When you send a file to someone and want them to confirm it arrived intact.
- To confirm two copies of a file are identical.
The same check in Terminal
shasum -a 256 ~/Downloads/YourFile.dmgWhat it does not prove
- A matching checksum proves the file equals what the publisher listed. It does not prove the publisher is trustworthy.
- If an attacker controls the page that lists the checksum, they can change both. Get the checksum from a separate trusted source when you can.
Frequently asked questions
Is my file uploaded?
No. The checksum is computed in your browser.
Does it work with multi-gigabyte files?
Yes. Large files are read in chunks, so memory use stays small. It takes longer on slower computers.
Why SHA-256?
It is a widely used checksum with no known practical collision attacks. Many projects list it next to their downloads.
What can I paste into the compare box?
Just the 64-character value, or a full line from shasum. The tool finds the hash in it.
Verify your download, then lock your files
Coming soon. Join the waitlist and we email the link.
Get early access