File Verifier

A checksum is a fixed-length value calculated from every byte in a file. Rename the file and the checksum stays the same. Change the contents and it changes. Checksum, hash, and digest all name the same value.

A download can stop partway, get corrupted in transfer, or be modified along the way, and none of that is visible in the file itself. Compare its SHA-256 with the checksum published by whoever released the file: a match means you have the bytes they published. It confirms the file, not the source.

Drop your file on this page and the tool calculates all four checksums in your browser. To check one, click “Paste hash” and paste the value published with the file. The algorithm is detected from its length, and the result shows match or mismatch, highlighted from the first character that differs.

The bytes you have are not the bytes that checksum was calculated from. A download that stopped partway is the usual cause, so delete the file and download it again from the original source. If a fresh copy still doesn't match, check that the published checksum belongs to the same version, then contact whoever provided the file.

Yes. Drop the first file, click “Compare file”, then drop the second. Both files get all four checksums, with match or mismatch shown per algorithm. Names, folders, and timestamps are ignored, so two copies saved under different filenames still match.

SHA-256. It is what Kurodyne uses for package records and the value download pages most often publish. Use SHA-512 when that is what the source published. MD5 and SHA-1 are here for older sources only: collisions can be constructed for both, so a match says nothing about whether a file was tampered with.

In principle, yes. A checksum has a fixed number of possible values while files do not, so collisions have to exist. For SHA-256, the odds of hitting one by accident are lower than the odds of your disk misreading the file. MD5 and SHA-1 are different: collisions can be constructed for both on purpose, which is why neither is safe for a security check.

It means the file you dropped is byte-for-byte the package a seller uploaded here. Sign in, drop a ZIP, and its SHA-256 is checked against Kurodyne's package records. A match shows you the product, and tells you if the seller has released a newer version since then. Calculating checksums needs no account. Matching a package does.

No. The file stays on your device and every checksum is calculated in your browser. The one thing that leaves is the SHA-256 of a ZIP, sent to Kurodyne while you are signed in so it can be matched against package records (see “Verified package”). That is 64 characters of text, never the file itself. Close the tab and nothing is left.

Yes. No account, no signup, and no file size limit: the file is read in slices instead of loaded whole. Signing in adds one thing, the Kurodyne package check for ZIP files.