File Checksum Online — SHA-256, MD5 + More

Drop the file, copy the publisher's published SHA-256 hash (from their SHA-256SUMS file or release page), paste it into the Verify section, and pick SHA-256. PDFFlare compares the hashes in constant time and shows ✓ Match or ✗ Mismatch. No upload — the file is read locally and never leaves your browser, which is what makes this safe to use even for sensitive downloads.

Any file. The tool reads the raw bytes — file extension and MIME type don't matter. Images, PDFs, archives (.zip, .tar.gz), ISOs, video files, packages (.deb, .rpm, .dmg), backups, encrypted blobs — all work. The hash is computed over the exact byte sequence the file contains.

Soft limit — the file has to fit in your browser's available memory. In practice, files up to a few hundred MB hash in seconds on a modern laptop. Files at 1 GB+ work but may take 10-30 seconds and use a lot of RAM during the read. The tool doesn't impose its own size limit; the limit is your machine.

Many publishers still ship MD5 or SHA-1 alongside SHA-256 — older Linux ISOs, legacy software releases, archive formats. We compute all five so you can verify against whatever the publisher provides. For new code or new release pipelines, default to SHA-256 — MD5 has been broken since 2004 and SHA-1 since 2017 for collision resistance, but both remain useful for non-security integrity checks against trusted sources.

When verifying an expected hash against a computed one, naive `===` comparison can leak timing information about which characters differ — useful in a server-side attack where an attacker tests many guesses. PDFFlare uses constant-time comparison (XOR every character, OR the differences) so timing is identical for any two strings of the same length. Probably overkill for client-side verification but free to do correctly.

Not currently — the tool processes one file at a time so the progress bar stays meaningful. For batch hashing of many files, use the command-line tools like `sha256sum` (Linux/macOS) or `Get-FileHash` (PowerShell). PDFFlare's strength is hashing a single file when you need a quick browser-based verification of a specific download.

No. Reading happens via the browser's File API, hashing happens in `crypto.subtle.digest()` (or our local MD5 module). Nothing crosses the network. You can verify by checking your browser's Network tab while the tool runs — there will be no requests to pdfflare.com during the hash computation.

Different ecosystems publish hashes differently. Linux SHA-256SUMS files use lowercase hex. Microsoft's PowerShell `Get-FileHash` outputs UPPERCASE hex. Some webhook integrations (older Slack, custom pipelines) use Base64. JWT signatures (when used as integrity hashes) use Base64 URL. Same digest, four representations — the tool converts in your browser so you don't need a separate Base64 tool.

The Hash Generator at /tools/dev/hash-generator hashes a string you type or paste — useful for cache keys, JWT signing, webhook signatures over a payload string. File Checksum hashes the raw bytes of a file — useful for download verification, file integrity, package verification. Different inputs, different intents, same underlying algorithms. Use whichever matches your input.

Yes. SHA-256SUMS files (used by Linux distros, GNU projects, and many open source releases) contain lines like `a1b2c3... filename.iso`. Copy just the hex hash portion (everything before the spaces and filename) into the verify field, leave the algorithm as SHA-256, and the tool confirms the match. Most publishers also publish a GPG signature of the SHA-256SUMS file itself — that's a separate verification step (chain of trust) that needs a GPG client.