Softonic

Checksum Verifier

Step 1 / 3

Checksums are short fingerprints computed from a piece of data, and publishers list them so you can confirm that a download or a configuration value was not corrupted or altered. This verifier computes the checksum of the text you paste with MD5, SHA-1, SHA-256, SHA-384, SHA-512 or CRC32, and when you also paste an expected value it tells you in one glance whether they match. Handy for checking API keys, licence codes, configuration snippets and short messages against the hash a vendor lists.

How to verify a checksum

  1. 1

    Paste the text

    Type or paste the text whose checksum you need, for example an API key, a licence code or a configuration snippet.

  2. 2

    Pick the algorithm

    Choose MD5, SHA-1, SHA-256, SHA-384, SHA-512 or CRC32. Use the same algorithm the publisher used for the value you are comparing against.

  3. 3

    Paste the expected value (optional)

    Add the hash from the publisher's page. The comparison ignores letter case; keep the hash exactly as listed.

  4. 4

    Read the verdict

    The computed checksum is shown for copying, and when an expected value was supplied the tool marks a match in green or a mismatch in red.

Which algorithm to use

Algorithm Output size Speed Collision-safe? Use for…
MD5 128 bits Fastest Broken Legacy compatibility only
SHA-1 160 bits Fast Deprecated Legacy; git still uses it
SHA-256 256 bits Medium Yes Modern standard
SHA-384 384 bits Medium Yes Systems that already use 384 bits
SHA-512 512 bits Medium Yes Extra paranoia / crypto keys
CRC32 32 bits Fastest No Quick corruption checks, not security

Use SHA-256 unless the publisher lists a different one. MD5 and SHA-1 still appear for legacy downloads but are trivially spoofable with modern hardware, use them only for casual corruption checks, not integrity verification against attackers. CRC32 is not a cryptographic hash at all: it catches accidental damage but offers no protection against deliberate tampering.

Where publishers list hashes

  • Linux distros: SHA-256 and SHA-512 next to each ISO download, often with a PGP-signed SHASUMS file.
  • Open-source releases (GitHub): hashes on the release page, often via shasum -a 256 in the README.
  • Enterprise software: MD5 or SHA-256 on download confirmations; some vendors publish a GPG-signed manifest.
  • Package managers: handle verification automatically (apt, yum, Homebrew). Manual verification only needed for direct downloads.

Verification tips

  • Fetch the hash from a different source than the file. If both come from the same compromised mirror, they can both be faked.
  • Check a GPG signature when available. A signed SHASUMS file proves the publisher (with their private key) stands behind the hashes.
  • Re-check the value after a transfer: if you move a file or a secret between machines, recompute its hash on both ends to confirm they agree.
  • Watch out for line breaks: a trailing newline or a missing one changes the hash completely. If your pasted text differs from the original by a single character, the checksum will not match.

Privacy

The text you paste is sent to our servers to compute the checksum, and in step-by-step mode it is kept in your browser storage between steps so you do not have to paste it again. It is not stored in a database and is not shared with anyone.

Frequently Asked Questions

Common causes: you copied the expected value from a different version of the release, the text carries extra spaces, tabs or line breaks (even one trailing newline changes the hash), or you selected a different algorithm than the publisher. Check that you are comparing the right text with the right hash line.

For casual corruption detection (did the download finish cleanly?), yes. For security-sensitive verification (was this file tampered with?), no, MD5 collisions can be engineered in seconds on commodity hardware.

CRC32 is a fast, non-cryptographic checksum used by ZIP files, PNG images and network protocols to catch accidental corruption. It detects random damage well, but an attacker can craft a collision in milliseconds, so never rely on it for security.

This tool works with pasted text, not files. To check a downloaded file, compute its hash on your own device (for example with sha256sum, Get-FileHash or a graphical tool) and compare the result with the value the publisher lists.

Related Tools

A1Z26 Cipher Encoder

Encode text using the A1Z26 cipher (A=1, B=2, ... Z=26) or decode a number sequence back to letters, with customizable separator.

AES Encrypt / Decrypt

Encrypt and decrypt low-risk text with AES OpenSSL ciphers. The passphrase is hashed with SHA-256 and the Base64 output is IV plus ciphertext.

Base32 Encoder and Decoder

Encode and decode Base32 strings using the RFC 4648 alphabet. Useful for TOTP secrets, case-insensitive tokens and human-typed identifiers.

Atbash Cipher Encoder

Encode or decode text with the Atbash cipher, a Hebrew substitution that maps A-Z to Z-A. Same operation encrypts and decrypts.

Base64 File Encoder

Encode any file (PDF, ZIP, image, executable) to Base64 text for embedding in JSON, email, YAML or data URIs. Runs locally, no upload.

Caesar Cipher Encoder

Encrypt and decrypt text using the Caesar cipher. Any shift 1-25, supports ROT13 as a special case, preserves punctuation and case.