Every file has a cryptographic fingerprint — a fixed-length string computed from its contents. Change one pixel, one letter, one bit, and the fingerprint changes entirely. That property makes hashes the standard tool for verifying that a download arrived intact and unmodified.
This guide covers computing hashes with our File Hash tool, when to trust MD5 versus SHA-256, and the download-verification workflow developers rely on.
How to Check a File Hash Online Free (3 Steps)
- Add the file. Drop it into the File Hash tool. The hashing runs in your browser — the file never uploads.
- Read the fingerprints. MD5, SHA-1 and SHA-256 appear instantly, computed locally.
- Compare. Paste the expected hash from the source site and compare character by character. Match = intact. Mismatch = corrupted or tampered.
MD5 vs SHA-256: Which to Trust
| Hash | Detects corruption? | Detects tampering? | Verdict |
|---|---|---|---|
| MD5 | Yes | No — collisions found | Corruption checks only |
| SHA-1 | Yes | Weak — collisions found | Avoid for security |
| SHA-256 | Yes | Yes | Use for anything security-critical |
The Unix community’s warning is blunt: MD5 is not a secure hash. It perfectly detects accidental corruption (a bad download, a truncated transfer) but can’t detect deliberate tampering, because attackers can craft files with matching MD5. For OS images, security software and anything sensitive, prefer SHA-256.
Frequently Asked Questions
What is a file hash used for?
Verifying downloads (match the hash the publisher lists), detecting corrupted transfers, deduplicating files, and confirming a file hasn’t changed since you last checked.
Why is MD5 considered insecure?
Researchers found ways to craft two different files with the same MD5 hash (a “collision”). That means a malicious file can carry the same MD5 as a legitimate one — so MD5 alone can’t prove the file is safe, only that it arrived intact.
Does the hash tool upload my file?
No — the hash is computed in your browser with JavaScript. The file never leaves your device, which is exactly the behavior you want when hashing sensitive files.
Hash it, compare, trust. For turning files into text (for embedding or transmission), the Base64 codec is the adjacent tool.
