Is this the file
they said it was?
A checksum is a short fingerprint of a file: change one byte and it changes completely. Drop in a download and compare its fingerprint with the one published next to it. Uploading a file to check it would be backwards — this reads it where it already is.
Paste any of the forms these come in — the whole line from a checksum file works too. Case and spacing do not matter.
MD5 and SHA-1 are here because software is still published with them, not because they are safe: both can be forged deliberately. For "did this download arrive intact" they are fine; for "did somebody tamper with this" use SHA-256.
A conventional online converter takes your file, puts it on someone else's disk, does the work there and lets you download the result. Two copies of your file then exist somewhere you cannot see, for as long as that company decides. Here the code that does the work is shipped to your browser instead of your file being shipped to a server: the bytes are read by this tab, transformed in memory, and written back out as a download. Our server never sees them, so there is nothing for us to keep, log or lose.
One thing is counted, and here it is: when a tool finishes, this page tells the server which tool ran and whether it worked — never the file, its name, its size or anything read out of it, none of which ever leaves this tab. It is how we know which tools are worth keeping. The record is the same kind we keep for a one-time link: a truncated IP address, a country and a region.
Once the page has loaded, these tools keep working with the network switched off. That is the simplest proof that nothing is being sent anywhere.
Frequently Asked Questions
Q: Is the file uploaded to hash it?
No. It is read from disk in chunks by this browser tab and hashed here. Nothing is sent to our server — which also means a 4 GB ISO costs you no upload and no waiting.
Q: Which algorithm should I use?
SHA-256 unless you were given something else. MD5 and SHA-1 are offered because plenty of projects still publish them, but both are broken against a deliberate attacker: a matching MD5 proves the download did not get corrupted, not that nobody replaced it.
Q: How do I compare it with what I was given?
Paste the published checksum into the compare box. It is matched against every algorithm at once, so you do not need to know which one it is, and the answer is a plain yes or no rather than two long strings to squint at.
Q: Can I hash a very large file?
Yes. The file is read and hashed in chunks rather than loaded into memory whole, so a 4 GB disk image works the same as a 4 kB one — it just takes longer.
Q: Why does a big file take a while?
Because the work is happening on your machine rather than on a server: the file is read off your disk and hashed here, a few megabytes at a time. The upside is the part you do not see — none of those gigabytes are being uploaded anywhere.
The same idea, applied to sending things rather than changing them.