Is MD5 still worth using?

An MD5 value may still help spot an accidental transfer error if that is the only digest you have, but it is not strong evidence against deliberate tampering. Prefer a trusted SHA-256 or SHA-512 digest when security matters. The tool offers older algorithms so you can compare what a publisher actually supplied; it does not make them safe.

Why is SHA-512 off by default?

Because it is rarely the one published, and every algorithm you tick is another pass over the file. All four can be ticked at once if you want them; the checkboxes only control which rows are computed.

What happens with a very large file?

The page reads the file into memory. It warns when a file is over 256 MB, but **does not enforce** a 256 MB limit. A large file may work on one device and fail on another. If it fails, use a local command such as `sha256sum` and compare against a digest from a source you trust.

I pasted a hash and it said the lengths are not comparable. What does that mean?

That the digest you pasted is a different length from every algorithm currently ticked, so the two cannot be compared at all. Calling that a mismatch would be a false accusation against the file, so the page says which of the two situations you are in and tells you to tick the matching algorithm.

File Hash Checker

File

Drop a file here, or choose one. Nothing is uploaded, so there is no server-side size limit — the only limit is this browser's memory, because WebCrypto has no way to hash a stream.

Algorithms

MD5 and SHA-1 are here because publishers still print them, not because they are safe. Both have practical collision attacks — someone can build a second file with the same digest. Use them to check that a download arrived intact, never to decide that a file is trustworthy.

Check against a published hash

Expected hash

Any of the usual shapes works: a bare digest, a sha256sum line, or the SHA256 (file.iso) = … form. The comparison is case-insensitive.

Hashes

Learn

File Hash Checker Guide

About this tool

Compute MD5, SHA-1, SHA-256 and SHA-512 for a file in your browser, then check the result against a hash you were given. The file is read locally and never uploaded. Pasting a published digest — including a whole sha256sum line — turns the result into a verdict rather than a row of hex for you to compare by eye, and re-pasting a different digest re-compares without reading the file again.

Questions

Is MD5 still worth using?: An MD5 value may still help spot an accidental transfer error if that is the only digest you have, but it is not strong evidence against deliberate tampering. Prefer a trusted SHA-256 or SHA-512 digest when security matters. The tool offers older algorithms so you can compare what a publisher actually supplied; it does not make them safe.
Why is SHA-512 off by default?: Because it is rarely the one published, and every algorithm you tick is another pass over the file. All four can be ticked at once if you want them; the checkboxes only control which rows are computed.
What happens with a very large file?: The page reads the file into memory. It warns when a file is over 256 MB, but does not enforce a 256 MB limit. A large file may work on one device and fail on another. If it fails, use a local command such as sha256sum and compare against a digest from a source you trust.
I pasted a hash and it said the lengths are not comparable. What does that mean?: That the digest you pasted is a different length from every algorithm currently ticked, so the two cannot be compared at all. Calling that a mismatch would be a false accusation against the file, so the page says which of the two situations you are in and tells you to tick the matching algorithm.