How to verify a file checksum
- Choose the downloaded file, or select several files and their checksum manifest.
- Use an expected SHA-256 from a trusted source. Keep filenames and relative paths consistent.
- Run the check and review every mismatch, missing file, extra file or read error.
- Copy or download the report. To create your own checksum list, use Calculate mode instead.
What a checksum checks
SHA-256 produces a 64-character hexadecimal digest from a file’s exact bytes. This can help check a download or compare a backup with a previously saved list. It does not inspect whether the file’s contents are useful, complete or safe.
A report, not a silent pass
Invalid manifest lines and duplicate paths block verification. Missing and extra files remain visible. Cancelling or changing the input clears the previous result, so an old match cannot be mistaken for a new check.
Practical limits
Each file is read into memory, one at a time. This version is intended for small and medium files, not multi-gigabyte downloads. Unsupported formats or size limits are reported before hashing. Empty directories and files not supplied by your browser are outside the check.
Implementation references: Web Crypto digest and GNU checksum output formats.
Checksum FAQ
What does a matching SHA-256 checksum prove?
It shows that the computed checksum matches the expected value. It does not establish who created the file or whether it is safe. Obtain the expected checksum from a source you trust.
Are my files uploaded?
No. The selected files are read and hashed in this browser. This tool does not upload their contents or save your filenames, files or results. Download or copy results before closing the page.
Which checksum manifest formats are supported?
This version accepts GNU untagged SHA-256: 64 hexadecimal characters, a space, a space or asterisk, then a filename. UTF-8, an optional initial BOM, LF or CRLF, and GNU escaped filenames are supported. BSD tagged lines, comments, MD5 and NUL-separated lists are not supported. Invalid lines block verification.
How are filenames and folders matched?
Choose files to match filenames only, or choose a folder to match paths relative to that folder, excluding its root name. Matching is case-sensitive, without trimming names or normalizing Unicode. Leading ./ is removed. Forward slash separates folders; backslash is a literal filename character. Duplicate paths block verification.
What do Missing and Extra mean?
Missing means a manifest entry has no corresponding selected file. Extra means a selected file has no manifest entry. Both prevent an all-matched result. The tool only checks what you select; it does not search your disk. The manifest itself is not automatically excluded from a folder selection.
What are the file size limits?
Select up to 200 files, each at most 64 MiB, and at most 512 MiB in total. A manifest can be at most 256 KiB with 200 entries. Files are processed one at a time, but each file is read fully into memory. Larger files are not supported in this version.
Why does the same-looking text have a different checksum?
Checksums use the exact file bytes, not the displayed text. A changed line ending, encoding, BOM, space or final newline changes the input. Renaming a file does not change its checksum, but it can prevent filename matching against a manifest.
Can I create a checksum manifest?
Yes. Use Calculate SHA-256 and select Download SHA256SUMS.txt after all files have been read successfully. The download is a GNU-compatible binary-mode list, UTF-8 with LF line endings. Verification mode exports a report, not replacement expected checksums.