How to Compute a File Checksum (MD5, SHA-1, SHA-256)

What is a file checksum?

A file checksum is a fixed-size string computed from the contents of a file using a cryptographic hash function. Even a tiny change to the file produces a completely different checksum. The most common algorithms are MD5, SHA-1, SHA-256, and SHA-512.

Checksums serve as digital fingerprints. They let you verify that a file was downloaded correctly, that it has not been tampered with, and that two copies of a file are identical. Software distributors publish checksums alongside their downloads, and operating systems use them internally to detect data corruption.

Common use cases

• Verifying downloads: Comparing the checksum of a downloaded file with one published by the author
• Detecting tampering: Ensuring a file has not been modified in transit or storage
• Backup verification: Confirming that backed-up files match the originals
• Deduplication: Identifying identical files in a storage system
• Build systems: Tracking the integrity of artifacts and dependencies

Method 1: Use UtilBoxx's free file checksum tool (Recommended)

Our file checksum tool computes MD5, SHA-1, SHA-256, and SHA-512 hashes of any file in your browser, with no upload. Here is how to use it:

1. Go to utilboxx.com/en/tools/crypto/checksum
2. Drop your file into the upload area (or click to select)
3. The hashes for all algorithms appear as they are computed
4. Copy any hash with one click
5. Use the "Compare" field to check against a known checksum

Why this method works:

• Files are processed entirely in your browser — never uploaded
• Supports MD5, SHA-1, SHA-256, and SHA-512 in parallel
• Works with files of any size (uses streaming)
• Built-in comparison against a published hash
• Mobile-friendly with drag-and-drop

Method 2: Use a built-in command line tool

On Linux, macOS, and modern Windows (PowerShell):

```bash # MD5 md5sum file.zip # Linux/macOS md5 file.zip # macOS Get-FileHash file.zip -Algorithm MD5 # PowerShell

# SHA-256 sha256sum file.zip # Linux/macOS shasum -a 256 file.zip # macOS Get-FileHash file.zip -Algorithm SHA256 # PowerShell ```

These commands are pre-installed and work on any file. They are the most common way to verify downloads in documentation.

Method 3: Use a language library

In Python:

```python import hashlib with open("file.zip", "rb") as f: print(hashlib.sha256(f.read()).hexdigest()) ```

In Node.js:

```javascript const crypto = require('crypto'); const fs = require('fs'); const data = fs.readFileSync('file.zip'); console.log(crypto.createHash('sha256').update(data).digest('hex')); ```

For large files, stream the data in chunks to avoid loading the whole file in memory.

Frequently asked questions

Is MD5 still safe to use?

For verifying file integrity (not security), MD5 is fine. For cryptographic purposes — like password storage or digital signatures — MD5 is broken and should not be used. Use SHA-256 or SHA-512 for security-sensitive applications.

What is the difference between SHA-1, SHA-256, and SHA-512?

They differ in output size and security. SHA-1 produces 160-bit hashes; SHA-256 produces 256-bit hashes; SHA-512 produces 512-bit hashes. Larger hashes are more collision-resistant. SHA-1 is deprecated for security use.

How do I verify a downloaded file?

Compute the checksum of the downloaded file using the same algorithm and compare it to the value published on the download site. If they match, the file is intact. If not, the file is corrupted or tampered with.

Can two different files have the same checksum?

In theory, yes — this is called a collision. For SHA-256, finding a collision is computationally infeasible. MD5 and SHA-1 have known practical collisions, which is why they are not recommended for security.

Conclusion

File checksums are a simple, powerful way to verify integrity. For a private, in-browser tool that works on any file, the UtilBoxx file checksum tool is the easiest way to compute and compare hashes.