How do I verify a SHA-256 checksum of a download online?

Drop the file, copy the publisher's published SHA-256 hash (from their SHA-256SUMS file or release page), paste it into the Verify section, and pick SHA-256. PDFFlare compares the hashes in constant time and shows ✓ Match or ✗ Mismatch. No upload — the file is read locally and never leaves your browser, which is what makes this safe to use even for sensitive downloads.

What file types are supported?

Any file. The tool reads the raw bytes — file extension and MIME type don't matter. Images, PDFs, archives (.zip, .tar.gz), ISOs, video files, packages (.deb, .rpm, .dmg), backups, encrypted blobs — all work. The hash is computed over the exact byte sequence the file contains.

Is there a file size limit?

Soft limit — the file has to fit in your browser's available memory. In practice, files up to a few hundred MB hash in seconds on a modern laptop. Files at 1 GB+ work but may take 10-30 seconds and use a lot of RAM during the read. The tool doesn't impose its own size limit; the limit is your machine.

Why are MD5 and SHA-1 still shown?

Many publishers still ship MD5 or SHA-1 alongside SHA-256 — older Linux ISOs, legacy software releases, archive formats. We compute all five so you can verify against whatever the publisher provides. For new code or new release pipelines, default to SHA-256 — MD5 has been broken since 2004 and SHA-1 since 2017 for collision resistance, but both remain useful for non-security integrity checks against trusted sources.

What does the constant-time comparison do?

When verifying an expected hash against a computed one, naive `===` comparison can leak timing information about which characters differ — useful in a server-side attack where an attacker tests many guesses. PDFFlare uses constant-time comparison (XOR every character, OR the differences) so timing is identical for any two strings of the same length. Probably overkill for client-side verification but free to do correctly.

Can I hash multiple files at once?

Not currently — the tool processes one file at a time so the progress bar stays meaningful. For batch hashing of many files, use the command-line tools like `sha256sum` (Linux/macOS) or `Get-FileHash` (PowerShell). PDFFlare's strength is hashing a single file when you need a quick browser-based verification of a specific download.

Does the file get uploaded to PDFFlare's servers?

No. Reading happens via the browser's File API, hashing happens in `crypto.subtle.digest()` (or our local MD5 module). Nothing crosses the network. You can verify by checking your browser's Network tab while the tool runs — there will be no requests to pdfflare.com during the hash computation.

Why are there four output formats?

Different ecosystems publish hashes differently. Linux SHA-256SUMS files use lowercase hex. Microsoft's PowerShell `Get-FileHash` outputs UPPERCASE hex. Some webhook integrations (older Slack, custom pipelines) use Base64. JWT signatures (when used as integrity hashes) use Base64 URL. Same digest, four representations — the tool converts in your browser so you don't need a separate Base64 tool.

How is this different from the text-input Hash Generator?

The Hash Generator at /tools/dev/hash-generator hashes a string you type or paste — useful for cache keys, JWT signing, webhook signatures over a payload string. File Checksum hashes the raw bytes of a file — useful for download verification, file integrity, package verification. Different inputs, different intents, same underlying algorithms. Use whichever matches your input.

Can I verify a file against a hash from a SHA-256SUMS file?

Yes. SHA-256SUMS files (used by Linux distros, GNU projects, and many open source releases) contain lines like `a1b2c3... filename.iso`. Copy just the hex hash portion (everything before the spaces and filename) into the verify field, leave the algorithm as SHA-256, and the tool confirms the match. Most publishers also publish a GPG signature of the SHA-256SUMS file itself — that's a separate verification step (chain of trust) that needs a GPG client.

File Checksum Online — SHA-256, MD5 + More

File checksum online — drop any file, get MD5, SHA-1, SHA-256, SHA-512 in one pass. Verify download integrity. 100% browser-based, no upload, free.

PDFFlare's file checksum online tool reads any file in your browser and computes its MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests in one pass. Use it to verify download checksum integrity (Linux ISOs, software releases, package downloads), as a sha256 file checksum verifier for backups, or as an md5 file hash online utility for archive integrity. The file stays local — nothing uploads to a server.

Drop the file, get all five hashes in seconds. Paste the publisher's expected hash and PDFFlare runs a constant-time compare and shows a green ✓ Match or red ✗ Mismatch instantly. For text-based hashing (strings, JWT payloads, cache keys), use the Hash Generator; for HMAC signing of webhooks and JWT HS256, the Hash Generator's HMAC mode covers it.

Acts as a file hash calculator, sha256sum online utility, file integrity checker, and download verification tool — all in one page. Output formats include lowercase hex (most common), UPPERCASE hex (Microsoft / Windows world), Base64 (Slack-style), and Base64 URL (JWT-adjacent). Free, browser-based, no signup.

Drop a file or click to upload

Any file type — images, PDFs, archives, ISOs. Hashed entirely in your browser.

Your file is hashed entirely in your browser using crypto.subtle.digest() for SHA + a small client-side MD5 implementation. The file is never uploaded to PDFFlare or anywhere else. Safe for sensitive backups, archives, and corporate downloads.

How to Verify a File Checksum

Drop your file
Drag any file into the upload area, or click to pick. Works with images, archives, ISOs, packages, backups — any binary. The file stays in your browser; nothing uploads.
Get every hash in one pass
MD5, SHA-1, SHA-256, SHA-384, and SHA-512 compute together as the file is read. Larger files (200 MB+) show a progress bar so you know how far the read is.
Pick your output format
Hex (lowercase) is what most projects publish. UPPERCASE hex matches Microsoft / Windows-world conventions. Base64 covers Slack-style signatures. Base64 URL is for JWT-adjacent contexts. Same digest, four ways to write it.
Verify against a published checksum
Paste the publisher's expected hash (from a SHA-256SUMS file, release notes, or download page) and pick the algorithm. The tool compares with constant-time equality and shows a green ✓ Match or red ✗ Mismatch immediately.

When Do You Need a File Checksum Online?

Verify Linux ISO + distro downloads: Ubuntu, Fedora, Debian, Arch, Mint — every major distro publishes SHA-256 of its release ISOs. Drag the downloaded .iso into PDFFlare's file checksum verifier, paste the published hash, get an instant ✓ Match. Catch corrupt downloads (truncated files, MITM-tampered images) before flashing your install media.

Verify software releases + binaries: Open-source releases on GitHub, GitLab, and project homepages frequently ship a checksums file alongside the binary. Use this sha256 file checksum verifier to confirm your downloaded zip / tarball / .dmg / .exe matches what the maintainers signed. Pairs with the verify-against-published-hash field for a one-click confirm.

File integrity in backup + archive workflows: When you copy a 50 GB backup to a new drive, hash the source and the destination — if the hashes match, byte-for-byte the copy is intact. Same workflow for archive verification after a long-term cold storage retrieval. Acts as a file integrity checker without installing anything.

Hash a sensitive file without uploading: Some files you don't want to upload to a third-party checksum service: encrypted backups, internal release builds, copyrighted material being archived. PDFFlare reads the file locally via the browser's File API and runs the digest in your browser — the file never crosses the network. Verify your safety by watching the Network tab while the tool computes.

Why Use PDFFlare's File Checksum Tool?

Five Algorithms in One Pass

MD5, SHA-1, SHA-256, SHA-384, SHA-512 — all computed from one read. Whatever format the publisher uses, the hash is already in front of you.

Built-in Verify Mode

Paste the expected hash, get an instant green ✓ Match or red ✗ Mismatch. Constant-time comparison so timing attacks are impossible.

100% Browser-Based

Web Crypto handles the SHA digests; a small client-side MD5 fills the gap. No file leaves your machine. Safe for sensitive backups, internal builds, and corporate downloads.

No Signup Required

Free, unlimited, no account, no rate limits. Plus four output formats (lowercase hex, UPPERCASE hex, Base64, Base64 URL) so you don't need a second tool to convert digests between encodings.

Frequently Asked Questions About File Checksum Verification

Password Generator

Random, passphrase, PIN

UUID Generator

v1, v4, v5, v7 + bulk

HMAC Generator

HMAC-SHA256 webhook signatures

Verify Checksum

Match a published hash to a file

Random Secret

JWT secrets, API keys, webhook keys

Hash Generator

MD5, SHA + HMAC signing