MD5 File Checksum Calculator
Compute the MD5 checksum of any file locally, even large ones, and compare it with the published hash to verify the download. Free and private.
No file selected yet. The checksum appears as soon as you pick a file.
The file is read in chunks inside your browser and is never uploaded.
What is MD5 File Checksum?
This tool calculates the MD5 checksum (128-bit digest) of a file you choose and compares it with an expected value. The file is read in 4 MB chunks inside your browser, so large files work and nothing is uploaded.
How to use MD5 File Checksum
- Click the drop zone or drag a file onto it; the file is read in chunks and a progress bar is shown.
- Check the File name and File size shown below to make sure you picked the right file.
- Paste the checksum published by the provider into Expected checksum — you get Match or Mismatch (case,
0xand a trailing file name are ignored). - Choose the Output format if you need uppercase hex or Base64, then click Copy.
Example
A file named hash-abc.txt containing the 3 bytes "abc" (no newline)
900150983cd24fb0d6963f7d28e17f72
Pasting this value (in any case) into Expected checksum shows Match.
When to use MD5 File Checksum
Use it to verify that a download, backup or copied file is intact when the publisher lists a MD5 checksum, or to record a checksum before transferring a file. A matching MD5 proves the file was not accidentally corrupted, but because MD5 is broken it does not prove that nobody tampered with it — prefer a SHA-256 checksum or a signature when one is offered. To hash a short string instead of a file, use the MD5 text hash generator.
How MD5 File Checksum works
The file is sliced into 4 MB pieces with the File API and each piece is fed into an incremental MD5 hasher, so memory use stays small and a progress bar can be shown. MD5 pads the message to a multiple of 512 bits (a 1 bit, zeros, then the 64-bit little-endian length) and processes each block with four rounds of 16 steps on four 32-bit words. Each step mixes in a message word, a sine-derived constant and a rotation. The final state, written little-endian, is the 128-bit (32 hex character) digest. The comparison with the expected checksum is done on the bytes of the digest, so upper/lowercase hex and Base64 are both accepted.
Common Use Cases
- Verify an ISO, installer or firmware image against the checksum on the download page
- Confirm a file copied to a USB drive, NAS or cloud storage is bit-for-bit identical
- Record MD5 checksums of release artifacts before publishing them
- Find out whether two files with different names have identical content
- Check files against old MD5 lists from legacy archives
Security Note
MD5 is broken for security. Practical collision attacks exist (e.g. the forged CA certificate of 2008 and the Flame malware), so two different files can share an MD5. It is still fine for detecting accidental corruption, but do not use it for signatures, certificates or passwords — use SHA-256 or SHA-3 instead. A checksum only proves integrity if the expected value comes from a trusted channel; an attacker who can replace the file can usually replace a checksum shown next to it. The file never leaves your browser.
FAQs
Is my file uploaded to a server?
No. The file is read with the browser File API and hashed in JavaScript/WebAssembly on your device. You can disconnect from the internet after the page has loaded and it still works.
How large can the file be?
The file is processed in 4 MB chunks, so size is limited mainly by time, not memory. Multi-gigabyte files work; speed depends on your device.
My MD5 does not match the published value. What now?
First make sure you compare the same algorithm and the same file (not a partially downloaded one). If the values still differ, download the file again from the official source; a persistent mismatch means the file is corrupted or not the one the publisher released.
What can I paste into Expected checksum?
The hex value in upper or lower case, with or without 0x, the Base64 form, or a whole line from a checksum file such as <hash> filename — only the first word is compared.