Check a file's hash

What a hash is actually for

A hash is a short fingerprint of a file's contents. Feed the same bytes in and you get the same string out, every time, on every machine, in every program that implements the algorithm. Change a single bit anywhere in the file and the output changes completely — not slightly, completely.

That property is the whole point. It means you can publish a 64-character string next to a download and anyone can confirm they received exactly what you sent, without needing to trust the connection, the mirror, or the content delivery network in between.

Comparing by eye is the part that fails

The weak link in checking a hash has never been the arithmetic. It is that people compare the first few characters and the last few and declare a match — which is precisely the comparison a deliberately altered file is built to survive, and an unreliable way to spot a truncated download too.

Paste the published value into the compare box instead. The answer is yes or no, over the whole string, and it ignores the things that trip a manual comparison up: capitals, stray whitespace, and the filename that md5sum prints after the hash.

Which algorithm, and why there are so many

"Broken" here has a specific meaning and a narrower one than it sounds. It means somebody can deliberately construct two different files with the same hash. It does not mean the algorithm has stopped detecting accidental damage, which it still does perfectly well — a corrupted download will not collide with the original by luck.

The practical rule: use whatever the source published, because a hash can only be compared with one of the same kind. Where you have a choice, prefer SHA-256.

When the hashes do not match

Work through it in this order. Download it again — an interrupted or truncated transfer is by far the most common cause, and costs nothing to rule out. Check the version, since publishers list hashes per release and per architecture, and the page often shows several. Check the algorithm, because a SHA-256 will never match an MD5 no matter how correct both are.

If it still differs after all three, stop and get the file from the original source rather than a mirror. A hash that does not match is the system working — it has told you something about these bytes is not what the publisher intended.

Hashing is not encryption

These get confused constantly. Encryption is reversible by design: it exists so that somebody with the key can get the original back. Hashing is deliberately one-way — there is no key, and no amount of computation turns a hash back into the file, because the output is far smaller than the input and most of the information is simply gone.

That is why a hash can be published openly next to a download. It reveals nothing about the contents, and is useful only for confirming that two things are identical.

Questions

How do I check the MD5 or SHA-256 of a file?

Drop the file onto this page, choose the algorithm, and the hash appears. Paste the value the download page published into the compare box and it will tell you plainly whether the two match. Nothing is uploaded — the file is read by this page on your own device.

What does it mean if the hashes do not match?

One of three things. The download was interrupted or corrupted, which is by far the most common. The published hash is for a different version than the one you downloaded. Or the file has been altered since it was published. Download it again from the original source first — that resolves most cases.

Which algorithm should I use?

Whichever the source published, because you can only compare like with like. If you have a choice, SHA-256. MD5 and SHA-1 are both broken for security — a determined attacker can construct a different file with the same MD5 — but they remain perfectly good at catching an accidentally damaged download, which is what most people are actually checking for.

Is MD5 still safe to use?

For detecting corruption, yes, and that is the everyday use. For proving a file has not been tampered with, no: MD5 collisions have been practical since 2004 and can be produced in seconds. If you are verifying something security-sensitive and only an MD5 is offered, treat it as a checksum rather than as proof of authenticity.

Why does the same file give a different hash on another site?

Almost always because a different algorithm was used, or the file is not byte-identical. Hashing is completely deterministic — the same bytes always produce the same hash, on every machine, in every tool, forever. If two hashes of the "same" file differ, the bytes differ, even when the filename does not.

Can I hash a large file?

Within what your device can hold in memory. SHA hashing uses your browser’s built-in cryptography, which is fast and hardware-accelerated; a large file takes a moment rather than a minute. Very large disk images may be better handled by your operating system’s own command.

Is my file uploaded?

No, and on this page in particular that is not a footnote. The reason to check a hash is to find out whether the bytes you have are the bytes you were meant to get. Sending them to somebody else’s server to be told what they are inverts the entire exercise. Open the Network tab, or disconnect from the internet — it still works.

What BriskFile will not do to you

• Your files never leave your device

  Every conversion runs in your browser. Open DevTools, watch the Network tab, and you will see no upload — because there is not one.

• No account, no email, no watermark

  Nothing to sign up for and nothing stamped on your images. There is no step between choosing a file and getting it back.

• No limits at the download button

  No daily cap, no file counter, no "upgrade to download". If the tool starts a job, it finishes it.

• Checkable, not just claimed

  Open the Network tab and convert something — nothing goes out. Or load the page, disconnect, and watch it keep working: the tool is already on your machine, and your file never leaves it.