What this tool does
File Hash / Checksum Verifier computes SHA-1, SHA-256, SHA-384, SHA-512, and MD5 digests for a selected file and checks the result against an expected checksum.
← All Tools
🔐 File Hash / Checksum Verifier
Pick a file and compute SHA-1, SHA-256, SHA-384, SHA-512, and MD5 digests locally in your browser, then verify it against an expected checksum. Your file never leaves this device.
For a bounded metadata-only review artifact, use the File Integrity Change Pack. File bytes and digest values are excluded.
How verification works
- The file is read with the browser File API and hashed locally with the Web Crypto API; SHA-1/256/384/512 are native, MD5 uses a bundled implementation.
- Paste an expected digest to compare it against the computed hash with a constant-time-style comparison. Casing, spaces, colons, and a leading
0xare normalized. - You can prefix the digest (e.g.
sha256:…) or let the tool infer the algorithm from the digest length. - MD5 and SHA-1 have known collisions; prefer SHA-256 or stronger for tamper and supply-chain checks.
File Integrity Manifest Workbench
Select up to 100 files (100 MB total) to create or verify a deterministic utilito.file-integrity.v1 manifest. File bytes are hashed locally and never uploaded.
Reports exact match, mismatch, missing, and extra paths. SHA-256 or stronger is required; MD5 and SHA-1 are excluded from manifests.
Compare two manifests
Paste a before and after manifest to classify added, removed, changed, and unchanged paths without reading file bytes. Each manifest is limited to 1,000 files and 1 MB of text.
Digests are compared only when algorithms match. An algorithm mismatch returns a typed error rather than comparing incompatible fingerprints.
Why it is useful
It is useful for verifying downloads, validating signed artifacts, detecting tampering, and confirming a file matches a published checksum — without uploading private files to a remote service.
How it works
The browser reads the selected file into memory, hashes the bytes locally with the Web Crypto API (and a bundled MD5), and compares a pasted expected digest with constant-time-style equality.
Best input
Pick one file at a time. Paste the expected digest from the publisher's release notes, checksums file, or signed manifest. Prefix it with sha256: (or another algorithm) to avoid ambiguity.
Verification tip
A matching SHA-256 or stronger digest gives high confidence the bytes are identical. A mismatch means the file differs from the expected version and should not be trusted.
Privacy note
Selected file bytes are processed locally in your browser and are not uploaded by this tool.
Important limitation
Hashes are fingerprints, not encryption or access control. MD5 and SHA-1 have known collisions and should not be relied on for integrity or tamper detection — prefer SHA-256 or stronger.
Quick answers
Is my file uploaded anywhere?
No. The file is read and hashed entirely in your browser. No bytes are sent to Utilito servers.
Can I verify multiple algorithms at once?
Yes. The default mode computes SHA-1/256/384/512 and MD5 together so you can compare against whichever digest your source published.
What does a digest mismatch mean?
The file's bytes differ from the expected version. Re-download the file, confirm the expected digest, and do not trust the mismatched copy for integrity-sensitive use.
Common Use Cases
Verify a download
Compare an installer or archive against the publisher's SHA-256 checksum before running it.
Check a build artifact
Confirm a compiled binary or container layer matches the checksum recorded in your release manifest.
Detect file drift
Re-hash a file later and confirm the digest is unchanged to prove it has not been modified.