Hash Comparison

Features

• Compare two hashes with a clear pass or fail verdict
• Hash a local file and check it against a published checksum
• Automatic algorithm detection from digest length
• Constant-time comparison
• Ignores case and whitespace differences

How to use it

1. To compare two hashes, paste one into each box.
2. To verify a download, switch mode and choose the file.
3. Paste the checksum published on the download page.
4. Read the verdict, it either matches or it does not.

What a matching checksum actually proves

A matching hash proves the file you have is byte-for-byte identical to the file the hash was computed from. That reliably catches truncated downloads, disk corruption and transmission errors, which is the everyday use.

It proves considerably less about tampering than people assume. If an attacker can modify the file on the server, they can usually modify the checksum published alongside it too, and you would verify the bad file against the bad hash and see a match. Checksums only defend against a compromised mirror when the hash comes from a different, trusted channel: the project's signing key, a separate domain, or a signature you verify with GPG. This is why serious projects publish signed hash files rather than a bare hex string.

Algorithm choice matters here. MD5 and SHA-1 are both broken for collision resistance, it is computationally feasible to construct two different files with the same digest, and this has been demonstrated with real PDFs and certificates. They remain adequate for detecting accidental corruption but must not be relied on where an adversary is involved. Prefer SHA-256 or SHA-512 for anything security-relevant.