Hash a file to verify it
Upload a downloaded installer or archive, read its hash, and match it to the digest the vendor published.
Why hash before you install
Vendors publish SHA-256 digests so you can confirm an installer was not truncated or swapped. Matching hashes are a basic hygiene step before you run a new binary.
This page hashes a file you upload and shows digests you can copy. Compare them to the vendor page character for character.
Hashing is not antivirus and not a signature check. It only answers whether your bytes match the digest author’s bytes.
Prefer official HTTPS vendor pages as the source of truth for the expected digest.
How to hash a file here
Upload the exact file you downloaded. Start the hash job and keep the tab open until digests appear.
Copy SHA-256 when the vendor posted SHA-256. Use MD5 only when that is the only digest they published.
Compare carefully. Do not ignore case differences if one side lowercases hex—normalize before you decide.
Hash again after a re-download if the first attempt mismatched.
- Upload the downloaded artifact.
- Copy the matching algorithm’s digest.
- Compare to the vendor posting.
SHA-256 and friends
SHA-256 is the common modern choice for vendor posts. It resists practical collision attacks better than MD5 for integrity marketing claims.
Some vendors also post SHA-512 or SHA-1. Use the algorithm they printed next to the file name you actually downloaded.
Different algorithms produce different strings for the same file. Never compare an MD5 to a SHA-256.
This page’s sibling MD5 tool focuses on MD5-only workflows still common on older mirrors.
Mismatch playbook
Mismatches usually mean a partial download, a mirror that served a different build, or a wrong file selected.
Re-download from the primary vendor, not a random mirror, then hash again.
If the vendor updated the build but not the web page digest, wait for their update or contact support—do not invent a match.
Never run an installer that fails the official digest when security matters.
What hashing does not replace
Code signing signature verification in the OS still matters for platforms that use it.
Antivirus scanning is a separate pass.
Permissions and least-privilege installs still matter after a hash matches.
A matching hash from a malicious vendor still installs malware—the digest only proves sameness.
After you verify
Record the digest in change notes when audits require it.
Prepared server copies expire. Your local file is what you install.
If you zip the installer, hash the zip if that is what the vendor posted—or hash the inner binary if that is what they posted.
Free limits apply per upload.
Team habits
Store expected digests beside internal software catalogs.
Teach new hires to hash before running unfamiliar tools.
Automate checks in CI when you distribute internal builds.
Do not paste digests from untrusted chat threads as gospel.
Take a minute after the file lands to open it once. Confirming early is cheaper than discovering a bad transfer when you are already away from the network. On the hash file page, that habit protects the exact file you came here to create.
Name files with a human subject and a date. Default download names collide, and cleanup tools delete keepers that look like temporary junk. On the hash file page, that habit protects the exact file you came here to create.
Prepared files on the worker expire on a short timer. The lasting copy is the one your browser wrote into your downloads folder. On the hash file page, that habit protects the exact file you came here to create.
Free use covers ordinary daily jobs with published size and count ceilings. Pro raises those ceilings and removes advertising when your volume needs it. On the hash file page, that habit protects the exact file you came here to create.
If a step fails, reproduce the same address or upload in a normal browser first. When the source itself will not play or open, this page will not invent a working file. On the hash file page, that habit protects the exact file you came here to create.
Keep this tab open until the browser finishes writing. Closing early is a common way to create a short file that looks complete until you open it. On the hash file page, that habit protects the exact file you came here to create.
Vidzilla focuses on one job at a time: one URL or one upload. Bulk crawlers and account takeovers are out of scope on these tool pages. On the hash file page, that habit protects the exact file you came here to create.
When you need a different format later, convert from the local file you already trust instead of re-fetching a page that may change or disappear. On the hash file page, that habit protects the exact file you came here to create.
Phone and desktop browsers both work when the paste or upload is valid. Unstable mobile networks are a frequent cause of truncated writes, so watch the download finish indicator. On the hash file page, that habit protects the exact file you came here to create.
Do not send passwords, unlock keys, or private account cookies into the paste box. Public page addresses and ordinary uploads are the intended inputs. On the hash file page, that habit protects the exact file you came here to create.
Read the size and type labels on every Analyze or convert result before you commit a free daily slot. Wrong rows waste the limit and fill your disk with files you will delete. On the hash file page, that habit protects the exact file you came here to create.
Questions about hashing files
Which hash should I use?
Use the algorithm the vendor printed next to your exact filename—often SHA-256.
What if the hash mismatches?
Re-download from the official source. Do not install a mismatched binary.
Is hashing the same as virus scanning?
No. Hashing checks sameness to a digest. Scanning looks for known malware patterns.
Do I need an account?
No. Upload and read digests within free limits.
Can I hash multiple files at once?
Hash one file per job on this page, or hash a published ZIP if that is the artifact.
Why do MD5 and SHA-256 differ?
They are different algorithms. Compare only like to like.