Loading page
About this tool
Create a deterministic local SHA-256 manifest for bounded file sets, compare it with a previous manifest, and review byte changes and duplicate digests without uploading files.
File Integrity Manifest Builder hashes every file in a folder or selection with SHA-256 and writes a deterministic JSON manifest listing each file's relative path, size, media type, last-modified time and 64-character digest, sorted by path so the same set always produces the same file. Load a manifest you saved earlier and it diffs the two, reporting digest matches, digest differences, files present only now, files present only in the baseline, and metadata-only changes. It is for anyone who needs to prove a set of files has not changed between two points in time — archives, evidence sets, design masters, release bundles — without uploading any of them.
Open File Integrity Manifest Builder on AltFTool — it loads instantly in your browser.
Press Choose files or Choose folder to select up to 200 files, 64.0 MB per file and 256.0 MB combined; folder selection keeps the browser-provided relative paths.
Optionally press Import manifest to load an earlier JSON manifest (up to 2.0 MB), then press Build manifest to read each file in turn and digest it locally with SHA-256.
Review Ordered file entries, Duplicate digest visibility and the Earlier-manifest comparison, then press Download manifest for file-integrity-manifest.json or Download counts only for file-integrity-counts-only.json.
A digest difference means the contents actually changed; a metadata-only difference means the bytes are identical and only the timestamp or media type moved, and the report separates the two.
Entries are sorted by relative path in ascending UTF-16 order with a fixed schema, so two manifests of the same folder are identical files and diff cleanly in version control.
Because every file is digested, identical content under different names groups automatically — you see which files are exact copies of each other without a separate dedupe pass.
Up to 200 files, with a per-file limit of 64 MB and a combined limit of 256 MB per run. Larger sets need to be split into several manifests, for example one per top-level folder.
No. Each file is read locally and digested with the browser's Web Crypto SHA-256, and the manifest records only paths, sizes, timestamps and digests — file contents are never embedded and never leave the device.
The file's bytes are unchanged and only its recorded size, media type or last-modified value differs — usually the result of a copy, a restore from backup, or a different browser reporting the type differently. The content is intact; the report lists these separately from real digest differences.
No. A digest match only proves the bytes are the same as the ones you recorded; it says nothing about who made the file, where it came from, or whether it is malicious. A manifest is a change-detection record, not a digital signature or a trust decision.