About this tool
Confirm that downloaded, transferred, or archived files match an expected SHA-256 digest and create manifests for future integrity checks.
File Checksum Verifier computes the SHA-256 digest of every file you select, using the browser's Web Crypto implementation on the exact bytes, and compares each result against an optional SHA256SUMS manifest. It handles up to 100 files at 100 MB each, 500 MB in total. The manifest parser follows the GNU coreutils layout: a 64-character lowercase hash, a space, then either a second space for text mode or an asterisk for binary mode, then the filename. Every file ends up in one of four states: matched, mismatched, not listed in the manifest, or a manifest entry with no matching file. When you are done you can download a fresh SHA256SUMS.txt covering the files you hashed, ready to publish alongside a release or archive.
- Hashes exact bytes locally with Web Crypto for up to 100 files, 100 MB each, and 500 MB total.
- Strictly validates GNU-style text or binary SHA256SUMS lines and rejects malformed or duplicate filenames atomically.
- Reports matches, mismatches, selected files not listed, and unused manifest entries, then exports a final-newline SHA256SUMS.txt.
How to use Checksum Verifier
Press Choose files and pick the files you want to hash; the counter shows how many of the 100 slots and how much of the 500 MB budget you have used. If you have a published checksum list, paste it into the Optional SHA256SUMS manifest box. The parser checks every line as you type and reports malformed lines, duplicate filenames, or filenames with characters that are not portable across operating systems, and hashing will not start until those are fixed. Press Calculate checksums and watch the progress indicator; large files take a few seconds each. The summary line then reads something like 3 matched · 0 mismatched · 1 not listed · 0 unused manifest. Press Download to save SHA256SUMS.txt.
When this tool is useful
- Confirming a downloaded Linux ISO, installer, or firmware image matches the hash the vendor published on their site.
- Release engineers producing a SHA256SUMS.txt to ship next to build artifacts on GitHub or an S3 bucket.
- Archivists checking that files copied to a backup drive or cloud folder arrived byte-for-byte intact.
- Security reviewers comparing a binary received by email against the digest a colleague sent over a separate channel.
- Data teams confirming a large CSV export was not truncated or altered during a transfer between systems.
Practical tips
- The expected digest is only meaningful if it came through a channel you trust. A hash copied from the same compromised page as the file proves nothing.
- Filenames in the manifest match case-insensitively after Unicode normalization, so Report.PDF and report.pdf are treated as the same entry and rejected as duplicates.
- Each file is loaded into memory before hashing. On a low-memory laptop or phone, files near the 100 MB limit may fail even though they are within the limit.
- Cancelling stops after the file currently being hashed finishes, so a 100 MB file will still complete before the cancel takes effect.
- A mismatch after a re-download often means the mirror serves a different build; compare file sizes first, then check the vendor page for an updated hash.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Check an installer against a vendor hash
Example input
ubuntu-24.04.iso plus the manifest line: e3b0c442...b855 *ubuntu-24.04.iso
Expected output
Summary: 1 matched · 0 mismatched · 0 not listed · 0 unused manifest, with a green Checksum matches badge on the file row.
The asterisk marks binary mode; a double space would mean text mode. Both are accepted, but the line must use one of them.
Publish a manifest for a release
Example input
app-1.4.0-mac.zip, app-1.4.0-win.zip, app-1.4.0-linux.tar.gz, no manifest pasted
Expected output
Three lowercase digests shown as not listed, then Download produces a three-line SHA256SUMS.txt ending in a newline.
Not listed simply means no manifest was supplied to compare against; it is the normal state when creating a manifest.
Validation checklist
- Make sure the expected hash came from a trusted, separate source.
- Resolve every manifest parse error before calculating; the tool will not skip bad lines.
- Investigate any mismatch before opening or installing the file.
- Check that filenames on disk exactly match the manifest entries.
- Store the downloaded SHA256SUMS.txt next to the files it describes.