Get the reference before comparing
A checksum is useful when you have a value to compare it with. Obtain the expected digest from the publisher’s authenticated release information or another trusted channel. Select the same algorithm: a SHA-256 value cannot be directly compared with SHA-512 output.
If the download page and the checksum can both be changed by the same attacker, matching them does not establish authenticity. A signed release can provide a different assurance when you verify the signature using a trusted key. A hash comparison alone does not inspect the program’s behavior or prove that a document is safe to open.
Hash the bytes you actually downloaded
Choose the local file and calculate its digest. The browser reads its bytes on your device and does not upload the contents. The file’s name is not part of the digest; renaming it leaves the result unchanged if the bytes stay the same.
Changing line endings, encoding, archive metadata or a trailing newline can change the digest. This is why hashing pasted text is not always equivalent to hashing the original file. An editor may normalize the data when it opens or saves it. Keep the downloaded original until verification is complete.
Try it with your own input
Your result
Compare the full value
SHA-256 produces a 256-bit digest, usually written as 64 hexadecimal characters. Paste the expected value into the comparison field without a filename, a command prefix or explanatory punctuation. Letter case in hexadecimal does not change the represented value.
The tool reports a match or mismatch using the complete digest. Comparing only the first few characters is a weaker check and can miss differences. If the publisher lists several files, confirm the digest belongs to this exact version, operating system, architecture and archive type.
Investigate a mismatch methodically
Start with the simple explanations: wrong algorithm, wrong release, incomplete download or comparison against the extracted file instead of the downloaded archive. Re-download from the trusted source and compare again. Do not edit a mismatch away or treat it as a harmless warning without knowing why it happened.
A mismatch tells you that the bytes do not match the reference under the chosen algorithm. It does not identify which byte changed or why. Network corruption, packaging changes and malicious replacement can all produce a difference. Preserve the original evidence if you need to report the issue to a publisher.
Respect the browser’s memory model
SubtleCrypto.digest takes the input data rather than streaming an arbitrarily large file through the browser API. Reading a whole file can consume significant memory, especially on a phone. This tool therefore caps input at 100 MiB.
For larger files, use an operating-system hashing command or a dedicated streaming tool. Check the command’s algorithm and compare the same file. The size limit is a practical resource boundary, not a statement that a larger file is less trustworthy or that the hash algorithm stops working above that size.
Keep integrity, identity and secrecy separate
A checksum summarizes content for comparison. A UUID identifies an object. A password grants access under an authentication system. None of these should be substituted for another just because the output is a long string.
The UUID guide and password guide explain the other tasks. When sending a checksum in JSON or CSV, keep it as text and preserve every character. The privacy and security collection connects the local tools with their limitations visible.
Common questions
Does the file leave my device?
No. The digest is calculated locally from the selected file’s bytes.
Does a matching checksum prove a file is safe?
No. It proves consistency with the reference digest; authenticity depends on the reference source, and safety needs other checks.
Why did renaming the file keep the hash unchanged?
The digest covers file bytes, not its filename.
Why is there a 100 MiB limit?
The browser API reads the input into memory. Larger files are better handled by a streaming operating-system tool.
Can I compare only the start of the digest?
Compare the complete value. A shortened comparison gives a weaker check.