File Integrity Checker

What is file integrity checking and why is it important?

File integrity checking verifies that a file has not been tampered with, corrupted, or altered since its original creation. It works by computing a cryptographic hash (a unique digital fingerprint) of the file and comparing it to a known, trusted hash value. If the hashes match, the file is authentic. This is crucial for verifying downloaded software, detecting malware infections, ensuring backup integrity, and confirming that files have not been corrupted during transfer.

How does the Integrity Checker compute file hashes?

The Integrity Checker uses the Web Crypto API (SubtleCrypto) built into modern browsers to compute SHA-1, SHA-256, SHA-384, and SHA-512 hashes. For MD5 (which is not available in SubtleCrypto), we use a native JavaScript implementation that runs entirely in your browser. All hashing happens locally - your file is read into memory, hashed, and the result is compared against the expected hash you provide. Nothing is uploaded to any server.

How do I get the expected hash for a file I downloaded?

Most legitimate software download pages provide checksums (usually SHA-256 or SHA-256) alongside the download link. Look for text like "SHA-256: e3b0c442..." or a separate .sha256 file. On Linux/macOS, you can generate a hash using terminal commands like sha256sum filename, shasum -a 256 filename, or md5 filename. On Windows, use CertUtil -hashfile filename SHA256 or Get-FileHash filename in PowerShell.

What does it mean if the verification fails?

If verification fails, the computed hash does not match the expected hash. This could mean: (1) The file was corrupted during download - try downloading again. (2) The file was modified after the original hash was generated - the file may be a different version or may have been tampered with. (3) You are using the wrong hash algorithm - ensure the expected hash was generated with the same algorithm you selected. (4) The file is from an untrustworthy source. Always re-verify after re-downloading before deciding the file is safe.

What hash algorithms are supported?

The tool supports five hash algorithms: SHA-256 (64 hex characters, recommended), SHA-512 (128 chars, strongest), SHA-384 (96 chars), SHA-1 (40 chars, legacy), and MD5 (32 chars, legacy). SHA-256 is the most commonly used for modern software distribution and is the default selection. The tool can auto-detect the algorithm from the hash length when you paste a hash value.

Can I verify multiple files at once?

The current interface verifies one file at a time. For batch verification, you can use the tool repeatedly for each file. We recommend keeping a record of expected hashes and verifying files as you download them. The tool preserves your expected hash input between file changes (until you explicitly clear it), making it easy to verify multiple files against the same expected hash.

Is MD5 still safe to use for integrity checking?

MD5 is cryptographically broken - meaning attackers can deliberately create two different files with the same MD5 hash (a collision). It should NOT be used for security-critical integrity verification. However, MD5 is still widely used in legacy systems and for non-security checksums (like in scientific data or internal file deduplication). Many older websites still provide MD5 hashes, so we include it for compatibility. For security, always prefer SHA-256 or SHA-512.

What is the difference between file integrity and file authentication?

File integrity verifies that a file has not been altered - it proves the file is exactly as it was when the hash was generated. File authentication goes further, proving WHO created the hash using digital signatures (like GPG or Authenticode). This tool provides integrity checking only. For authentication, you would need to verify a cryptographic signature using the creator's public key, which is a separate process typically done with tools like GPG.

What file sizes can this tool handle?

The tool can handle files up to the memory limit of your browser. Since files are read entirely into memory for hashing, very large files (2GB+) may cause performance issues on devices with limited RAM. For most use cases - software installers, documents, images, ISOs - the tool handles files smoothly. The processing time depends on file size and algorithm: SHA-512 is slower than SHA-256 for large files. Processing time is displayed in the results.

Why does the expected hash format not matter?

Hash values can be displayed in various formats - all lowercase, all uppercase, with colons (AB:CD:EF:12), with spaces, or with dashes. The Integrity Checker automatically normalizes the expected hash by converting to lowercase and removing all separators before comparison. This means you can paste a hash in any common format and it will work correctly. The computed hash is always displayed in lowercase hex format without separators.