Check a file’s hash, without uploading it

How to verify a download

1. Drop the file you downloaded into the box above.
2. Paste the checksum from the download page into the compare field, or drop the small .sha256 or .md5 file that came with the download.
3. Read the verdict. A match means your copy is byte-for-byte identical to the file the publisher released.

Why checksums matter

A checksum is a short fingerprint of a file. If even one byte changes, through a broken download, a failing disk, or tampering, the fingerprint changes completely. Publishers list checksums so you can confirm the file you received is exactly the file they released. Checking takes seconds and catches problems before you open or install anything.

Supported algorithms

MD5, SHA-1, SHA-256, SHA-384, SHA-512, BLAKE3 and CRC-32, all computed in a single pass over the file. The compare field recognises the algorithm automatically from the length of the value you paste.

Seven algorithms, two different jobs

This tool computes seven checksums in a single pass over each file (CRC-32, MD5, SHA-1, SHA-256, SHA-384, SHA-512 and BLAKE3) and shows all seven at once rather than making you pick one up front, since download pages and software vendors don't all publish the same algorithm. SHA-256 and BLAKE3 are flagged "recommended" in the results: both are modern, cryptographically strong hash functions with no known practical way to construct two different files that hash to the same value, which matters if you ever need to trust the checksum against a deliberate adversary rather than just an accident.

Why MD5 and SHA-1 are still on the list despite being "broken"

MD5 and SHA-1 are broken in a specific, narrow sense: researchers have demonstrated ways to deliberately construct two different inputs that produce the same hash (a collision), which means neither should be trusted to verify a file's authenticity against someone actively trying to fool you — software signing, for instance, has moved on to SHA-256 or better for exactly this reason. That weakness is irrelevant to the far more common use of a checksum: catching accidental corruption. A truncated download, a bit flipped by a failing disk, or a copy that silently stopped partway through will change an MD5 or SHA-1 hash just as reliably as it changes a SHA-256 one, which is why so many older download pages still publish an MD5 alongside the file. It was never about defeating an attacker, just proving the bytes arrived intact.

Verifying a download without the manual copy-paste

Paste the checksum a download page lists into the compare field and Morphr figures out which algorithm it is from the length of the string: 8 hex characters is CRC-32, 32 is MD5, 40 is SHA-1, 64 is either SHA-256 or BLAKE3 (both happen to produce the same length, so both are checked), 96 is SHA-384 and 128 is SHA-512. You can also just drop the small checksum file that often ships alongside a download (a .sha256, .md5, .sfv, or similar sidecar file, as long as it's under 64KB) instead of opening it and copying the value by hand; Morphr recognizes these by extension, reads the hex value out of it automatically (skipping comment lines and any accompanying filename), and drops it straight into the compare field.

Hashing a file that never has to leave your device

The file is read in chunks with a visible progress bar rather than loaded all at once, which is what makes hashing a multi-gigabyte video file or a disk image practical without freezing the tab, and it means a checksum-based web tool never has to see, or even know you possess, whatever you're hashing, unlike uploading it to a server-side checker. Once a batch of files is done, the "export checksums" button writes out a small text file with one line per file in the classic `<hash> <filename>` format that most checksum utilities expect — note that this export always uses the SHA-256 value specifically, even though the other six algorithms are still visible and copyable individually above it.