MD2 File Checksum Calculator
Compute the MD2 checksum of any file locally, even large ones, and compare it with the published hash to verify the download. Free and private.
No file selected yet. The checksum appears as soon as you pick a file.
The file is read in chunks inside your browser and is never uploaded.
What is MD2 File Checksum?
This tool calculates the MD2 checksum (128-bit digest) of a file you choose and compares it with an expected value. The file is read in 4 MB chunks inside your browser, so large files work and nothing is uploaded.
How to use MD2 File Checksum
- Click the drop zone or drag a file onto it; the file is read in chunks and a progress bar is shown.
- Check the File name and File size shown below to make sure you picked the right file.
- Paste the checksum published by the provider into Expected checksum — you get Match or Mismatch (case,
0xand a trailing file name are ignored). - Choose the Output format if you need uppercase hex or Base64, then click Copy.
Example
A file named hash-abc.txt containing the 3 bytes "abc" (no newline)
da853b0d3f88d99b30283a69e6ded6bb
Pasting this value (in any case) into Expected checksum shows Match.
When to use MD2 File Checksum
Use it to verify that a download, backup or copied file is intact when the publisher lists a MD2 checksum, or to record a checksum before transferring a file. A matching MD2 proves the file was not accidentally corrupted, but because MD2 is broken it does not prove that nobody tampered with it — prefer a SHA-256 checksum or a signature when one is offered. To hash a short string instead of a file, use the MD2 text hash generator.
How MD2 File Checksum works
The file is sliced into 4 MB pieces with the File API and each piece is fed into an incremental MD2 hasher, so memory use stays small and a progress bar can be shown. MD2 pads the message to a multiple of 16 bytes (each padding byte equals the number of padding bytes), appends a 16-byte checksum computed with a substitution table derived from the digits of pi, and then processes every 16-byte block through 18 rounds over a 48-byte state using the same S-box. The first 16 bytes of the state are the 128-bit digest. It is byte-oriented and very slow compared with modern hashes. The comparison with the expected checksum is done on the bytes of the digest, so upper/lowercase hex and Base64 are both accepted.
Common Use Cases
- Verify an ISO, installer or firmware image against the checksum on the download page
- Confirm a file copied to a USB drive, NAS or cloud storage is bit-for-bit identical
- Record MD2 checksums of release artifacts before publishing them
- Find out whether two files with different names have identical content
- Check files against old MD2 lists from legacy archives
Security Note
MD2 is obsolete and insecure. Preimage and collision attacks are known (RFC 6149 moved MD2 to Historic status). Use it only to reproduce or check values from legacy systems such as old X.509 certificates; never for signatures, passwords or integrity against an attacker. A checksum only proves integrity if the expected value comes from a trusted channel; an attacker who can replace the file can usually replace a checksum shown next to it. The file never leaves your browser.
FAQs
Is my file uploaded to a server?
No. The file is read with the browser File API and hashed in JavaScript/WebAssembly on your device. You can disconnect from the internet after the page has loaded and it still works.
How large can the file be?
The file is processed in 4 MB chunks, so size is limited mainly by time, not memory. Multi-gigabyte files work; speed depends on your device (MD2 is especially slow).
My MD2 does not match the published value. What now?
First make sure you compare the same algorithm and the same file (not a partially downloaded one). If the values still differ, download the file again from the official source; a persistent mismatch means the file is corrupted or not the one the publisher released.
What can I paste into Expected checksum?
The hex value in upper or lower case, with or without 0x, the Base64 form, or a whole line from a checksum file such as <hash> filename — only the first word is compared.