How to check a file's hash
- Drop the file you downloaded onto the box above, or click Choose files. Any type of file works, up to 8 GB each and 20 files at a time.
- Copy the checksum from the official download page, often labelled SHA256, SHA-256 or checksum, and paste it into the Expected hash field. The tool picks the right algorithm from its length.
- Click Calculate hashes. Large files are read in pieces, and the progress bar shows how far it has got.
- Look for the green match badge. A red no match means the file is not the one the publisher hashed.
- Use the copy button next to a hash to paste it elsewhere, for example into a search or a bug report.
What a file hash proves
A cryptographic hash is a short fingerprint computed from every byte of a file. Change a single byte and the SHA-256 value changes completely. When the hash of your download equals the one on the developer's official page, the file is bit-for-bit identical to the one they published: it was not cut off, corrupted in transit, or replaced on a mirror.
A matching hash does not prove that the publisher's file is safe, only that you have the same file. Download from the official site in the first place; our guide to checking whether an EXE file is safe explains the other checks, such as the digital signature.
SHA-256, SHA-1 or MD5?
Use SHA-256 whenever the publisher offers it. MD5 and SHA-1 are still printed on some older download pages and work for spotting accidental damage, but both are broken for security: researchers have created different files with the same MD5, and in 2017 Google and CWI Amsterdam published two different PDF files with the same SHA-1 hash.
Doing it in Windows without a browser
Windows has hashing built in. In PowerShell, run the command below; SHA256 is its default algorithm.
Get-FileHash "C:\Users\You\Downloads\file.iso"In Command Prompt, the same result comes from certutil:
certutil -hashfile "C:\Users\You\Downloads\file.iso" SHA256Supported files and limitations
- Accepts any type of file.
- Up to 20 files at a time, 8 GB each.
Files up to 128 MB are hashed with your browser's built-in Web Crypto code. Larger files are read in 4 MB pieces in a background thread, so memory use stays low even for multi-gigabyte ISO images.
Speed depends on your disk and processor; a file of several gigabytes can take a few minutes.
The comparison ignores spaces, upper or lower case and a leading SHA256: label, so you can paste the checksum exactly as the site shows it.
Hashes of folders are not supported; zip the folder first or hash the files one by one.
Privacy and security
Your files are opened and processed by your own browser. The ExeDepot server only delivers this page and its scripts; it never receives your files, their contents or their names. The page loads no third-party scripts or ads, and its Content Security Policy allows connections only back to exedepot.com.
Results exist only in your browser's memory until you download them, and they are discarded when you click Hash more files or close the tab. No online tool can promise perfect security, so keep your browser up to date, and for documents you would never put online consider an offline desktop app such as 7-Zip.
Frequently asked questions
How do I check the SHA-256 of a downloaded file?
Drop the file onto this page, paste the SHA-256 value from the official download page into Expected hash, and click Calculate hashes. A green match badge means the file is genuine and complete.
What does it mean if the hash does not match?
The file differs from the one the publisher hashed. Most often the download was interrupted or corrupted; sometimes the checksum on the page belongs to another version. Download again from the official site. If it still does not match, do not run the file.
Is my file uploaded to calculate the hash?
No. The hash is computed in your browser, on your device. That is also why the tool can handle multi-gigabyte ISO images that would take a long time to upload.
Is SHA-256 the same as a checksum?
SHA-256 is one kind of checksum. Download pages also use the word for MD5 or SHA-1 values. The tool tells them apart by length: 64 characters for SHA-256, 40 for SHA-1 and 32 for MD5.
Which free programs show file hashes in Explorer?
7-Zip adds a CRC SHA item to the right-click menu of every file, with SHA-256 among its options. WinMerge compares files byte by byte if you have both copies.
7-Zip
WinMerge
HxD