Open the Vootkit workspace.
01Privacy toolTool result
File Checksum
Verify a download with its SHA-256 hash.
100% FreeRuns instantlyNo watermark
- 1Choose toolOpen the Vootkit workspace.
- 2Add inputProvide the content or settings.
- 3ProcessLet the browser do the work.
Private by designProcessed on your device where possible.
Works on any deviceDesktop, tablet and mobile browsers.
No installationOpen the page and start working.
Always free coreUse the free plan for everyday tasks.
How to use File Checksum
Provide the content or settings.
02Let the browser do the work.
03Copy, download or continue.
04Your files stay private
Your work is processed locally in your browser where possible and is never added to a Vootkit upload library.
Learn more about privacyA checksum answers one question precisely: is this file byte-for-byte the file it should be? It is how you confirm a download was not corrupted, and how you notice if it was replaced.
What File Checksum does
Computes SHA-1, SHA-256 and SHA-512 hashes of a file, so you can compare against the value a publisher provides.
The comparison is all-or-nothing: change one byte anywhere in the file and the entire hash changes. There is no such thing as a nearly-matching checksum.
Algorithms and use
| SHA-256 | The current default for verification |
|---|---|
| SHA-512 | Longer digest, same guarantees |
| SHA-1 | Legacy — still published, no longer collision-resistant |
| MD5 | Deliberately not offered — broken |
| Sensitivity | One changed byte changes the whole hash |
| Matching | Exact or not at all |
| File handling | Read in your browser — never uploaded |
| Large files | Hashing is fast; reading from disk is the limit |
Detailed steps
- Add the file.
- Copy the hash for the algorithm the publisher used — usually SHA-256.
- Compare against theirs. It matches exactly or it does not match.
Worth knowing
Get the expected checksum from a different place than the file. If both come from the same page, an attacker who replaced the download replaced the checksum beside it, and the verification proves nothing. Publishers often post hashes on a separate release page, a signed announcement or a mailing list for exactly this reason.
Frequently Asked Questions
Which algorithm should I use?
SHA-256 unless the publisher specifies otherwise — it is the current default and what most projects publish. SHA-512 is equally fine. Use SHA-1 only when that is the only value provided, and treat it as a corruption check rather than a security guarantee.
Why is MD5 not offered?
Because it is broken. Collisions can be produced deliberately, so a matching MD5 does not establish that a file is the intended one. Offering it would invite exactly the false confidence a checksum is meant to prevent.
The checksum does not match — what now?
Do not open the file. It is either corrupted in transfer or it is not the file the publisher released. Download again from the official source; if it still differs, stop and report it.
Is my file uploaded?
No. It is read and hashed in your browser, which matters because verifying a file usually means it is one you have not yet decided to trust.
Is File Checksum free?
Yes. The Vootkit free plan includes 5 tool runs a day. Upgrade to Vootkit Pro for unlimited daily use, an ad-free workspace and saved workflows.
Are my files uploaded?
No. File Checksum runs entirely in your browser — your file is processed on your own device and never sent to a server. There is nothing for us to store or delete.
Do I need to install anything?
No. File Checksum works in any modern browser on desktop, tablet or phone. Open the page and start.
How often can I use it? Is there a daily limit?
On the free plan you get 5 tool runs a day. When you reach the limit you'll see a prompt to upgrade, and it resets the next day. Vootkit Pro removes the cap entirely for unlimited daily use.
Recently viewed
This tool processes everything locally in your browser. You can disconnect from the internet after the page loads and it will still work.