Paste two hashes: the tool normalises them (case, spaces, colons, prefixes like sha256-), tells you whether they match, the probable algorithm and the position of the first difference.
Case, spaces, colons and prefixes such as “sha256-” are ignored.
This tool checks whether two hashes are identical without you having to read them character by character. Use it to compare the checksum a vendor publishes with the one you computed, or two certificate fingerprints shown in different formats.
Before comparing, both values are normalised: converted to lowercase, stripped of spaces, line breaks and colons, and cleared of a leading algorithm prefix such as "sha256-" or "sha256=". As a result, "AB:CD:EF" and "abcdef" are treated as equal, and so are "sha256=2cf24d…" (GitHub's format) and "2cf24d…". The length of the normalised value is then used to estimate the algorithm: 32 hex characters for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512. This detection is only a probability, since SHA3-256 or BLAKE2s also produce 64 characters.
The comparison runs in constant time: the tool goes through every character instead of stopping at the first mismatch, a standard precaution so that timing does not reveal where two secrets differ. When the values do not match, the position of the first differing character is shown, which helps spot a truncated copy or a selection mistake. Different lengths often indicate two different algorithms, for example a SHA-1 compared with a SHA-256. A match only proves that your file is identical to the one used to produce the reference: trust depends on where that reference came from, ideally an official HTTPS page or a signed file.
Enter the official or expected hash in the first field, with or without separators or prefix.
Add the hash you computed or received in the second field.
The tool shows whether the two values match, the probable algorithm based on length and, if they differ, the position of the first difference.
Paste the value from the download page (Ubuntu, VeraCrypt, Python…) and the one from sha256sum or Get-FileHash. PowerShell prints the hash in uppercase and the page shows lowercase: the tool compares case-insensitively.
Browsers and OpenSSL often show a certificate's SHA-256 fingerprint as "AB:CD:…". Compare it with a value without separators from a configuration file or a colleague to confirm it is the same certificate.
While debugging, compare GitHub's X-Hub-Signature-256 header, prefixed with "sha256=", with the HMAC you recomputed: the prefix is ignored automatically.
Input
Reference hash: AB:CD:EF; Hash to check: abcdefResult
The hashes match: once case and colons are ignored, both values read abcdef.Compute the file's hash with the algorithm the vendor specifies, for example with sha256sum on Linux, shasum -a 256 on macOS, Get-FileHash on Windows or the hash generator. Then paste that value and the official value into the two fields. If they match, your file is identical to the published one.
Not hex hashes: "A1B2" and "a1b2" represent the same bytes, which is why PowerShell (uppercase) and sha256sum (lowercase) give equivalent results. In Base64, however, uppercase and lowercase letters encode different values. It is best to compare the hex form.
Length is the best clue: 32 hex characters for MD5, 40 for SHA-1, 64 for SHA-256, 96 for SHA-384 and 128 for SHA-512. It is not certain, because other algorithms produce the same lengths (SHA3-256 also gives 64 characters). The file name (SHA256SUMS) or the vendor's documentation settles it.
Your file differs from the one used to compute the reference: an interrupted download, a corrupted file, the wrong version or a malicious change. First check that you are comparing the right file with the same algorithm, then download it again from the official source. Do not run a file whose hash does not match.
A naive comparison stops at the first differing character, so response time can reveal how many characters are correct. That is a real server-side risk for HMAC signatures or tokens, which is why crypto.timingSafeEqual or hmac.compare_digest exist. The tool follows the same good practice, even though the risk is negligible in your own browser.
No, it proves that your file is identical to the reference file, not that the reference is clean. If the website and its checksum were compromised together, both values will still match. A GPG or Sigstore signature verified with the vendor's key provides that extra guarantee.
Related tools
Tools similar or complementary to this one.
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of a text or file in one go.
Compute an HMAC-SHA-1, SHA-256, SHA-384 or SHA-512 in hex or Base64 and verify a webhook signature.
Decode a PEM X.509 certificate or CSR: subject, issuer, dates, SANs, public key and SHA-256 fingerprint.
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
Learn when to use encryption, hashing, HMAC or key derivation for confidentiality, integrity, authentication and password handling.
Understand how SRI hashes help detect unexpected changes to static third-party scripts and stylesheets, and where SRI does not apply.
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.