Loading page
About this tool
Hash a local file with SHA-256, SHA-384, or SHA-512 and compare it with a publisher-provided checksum without uploading the file.
File Checksum Comparator hashes a file you choose with SHA-256, SHA-384 or SHA-512 using the browser's Web Crypto API and compares the resulting hex digest against the checksum a publisher gave you, in a constant-time character comparison. Paste the expected value and the algorithm is inferred from its length — 64 hex characters for SHA-256, 96 for SHA-384, 128 for SHA-512 — with the file read locally and never uploaded. It is for anyone verifying an installer, ISO, firmware image or archive actually matches what the vendor published.
Open File Checksum Comparator on AltFTool — it loads instantly in your browser.
Under "1. Choose the file", select any local file up to 512 MB — it is read and hashed inside this browser tab, not uploaded.
In "2. Paste and compare", paste the publisher's value into Expected checksum, leave Algorithm on "Detect from checksum length", and press Compare checksum.
The page returns "Checksums match" or "Checksums do not match" and shows the Calculated SHA-256/384/512 digest with a Copy calculated hash button.
Leave the selector on auto and the SHA-2 variant is chosen by the checksum's length, so you cannot accidentally compare a SHA-512 value against a SHA-256 digest.
Leading labels like "SHA256:" or "checksum =", stray whitespace and uppercase hex are all stripped before comparison, so you can paste a line straight off a release page.
The two digests are compared with an XOR accumulation over every character rather than an early-exit string equality, so the check does not leak timing information.
64 hexadecimal characters. SHA-384 is 96 and SHA-512 is 128, and the tool rejects any pasted value whose length does not match the selected algorithm or contains non-hex characters.
No. The file is read into memory in your own browser and digested with crypto.subtle.digest, so nothing about it leaves the machine — which is why you can safely verify confidential builds and licensed installers here.
Up to 512 MB. The whole file is loaded into memory to be hashed, so very large images may be slow or may fail on a low-memory device even under that limit.
Do not open or run the file. A mismatch means the bytes you have differ from the bytes the publisher hashed, most often from an incomplete or corrupted download — re-download from the official source and check again; if it still fails, treat the file as untrusted and report it to the publisher.