What a matching hash proves
That the file you have is byte-for-byte the one the publisher hashed. That reliably catches a truncated download, a corrupted transfer and a mirror serving an old version.
What it proves about tampering depends entirely on where the checksum came from. A checksum published on the same page as the download, on a compromised server, is worth nothing — whoever replaced the file replaced the checksum too. Compare against a value from an independent source: the project’s signed release notes, a different domain, a package manager.
Which algorithm
SHA-256 is what nearly every project publishes now. MD5 and SHA-1 are still seen and are broken for security — a file can be constructed to match a given MD5 — though they remain fine for spotting accidental corruption.
Comparison here is case-insensitive and ignores surrounding whitespace, because published checksums are formatted inconsistently and a mismatch caused by a stray space is a false alarm nobody needs.
Frequently asked questions
Does a matching hash mean the file is safe?
It means it is identical to the one hashed. If the checksum came from the same place as the file and that place was compromised, both were replaced. Compare against an independent source.
Which algorithm should I use?
SHA-256, which is what projects publish. MD5 and SHA-1 catch corruption but are broken against deliberate tampering.
Is my file uploaded?
No — it is read and hashed in your browser, which also means very large files work without an upload.
Something wrong with this tool, or an idea for it? Tell us