How to check a file’s SHA-256 hash
- Drop the file onto the box, or tap Choose file.
- Wait for the progress bar. Small files finish instantly; large ones show progress and can be cancelled.
- Copy the fingerprint, or paste a published checksum into Expected checksum to verify it. Upper or lower case, spaces and prefixes like
sha256:are ignored.
Timestamp a file for free
After fingerprinting a file, press Timestamp this file. You get a small .ots proof to download and a printable certificate. The proof uses OpenTimestamps, an open standard that anchors fingerprints in the Bitcoin blockchain through free public calendar servers. Nobody, including us, can change or back-date it later.
What it proves
- This exact file existed no later than the Bitcoin block’s time.
- Anyone can check it with free, open-source tools.
What it does not prove
- Who made, owns or signed the file.
- That it did not exist earlier, or that it is true.
- It is not a notarisation or an eIDAS qualified timestamp.
We picked OpenTimestamps because it is free, needs no account and can be checked by anyone without trusting a company. Traditional RFC 3161 timestamps from a timestamp authority are also free from some providers, but they cannot be requested from a browser directly; we will add them as an option once a small relay is in place.
When a file fingerprint is useful
- Verifying downloads. Software, firmware and operating system images publish checksums so you can confirm nothing was corrupted or swapped on the way.
- Proving a document has not changed. Record the SHA-256 of a contract, invoice or evidence file when you send it. If anyone later shows you a copy, its fingerprint will tell you whether it is the same file.
- Finding duplicates. Two photos or videos with the same fingerprint are the same file, whatever their names.
- Checking backups. Compare the original and the backup copy to make sure the copy is complete.
Why the file never leaves your device
Many online hash tools upload your file to a server first. That is slow for big files and a bad idea for anything private. This tool reads the file with your browser’s File API and hashes it with a small WebAssembly library (hash-wasm) in your own tab. You can disconnect from the internet after the page loads and it still works.
SHA-256 vs SHA-1 vs MD5
| Algorithm | Length | Use it for |
|---|---|---|
| SHA-256 | 64 hex characters | Everything: integrity checks, signatures, tamper evidence |
| SHA-1 | 40 hex characters | Matching older published checksums only |
| MD5 | 32 hex characters | Matching older checksums and quick duplicate checks only |
Signing documents that need to stay unchanged?
We are working on e-signing that records each document’s fingerprint, so anyone can check later that a signed file was not altered. Get notified when it opens.
Questions people ask
Is my file uploaded anywhere?
No. The file is read in small pieces by your own browser and hashed with WebAssembly on your device. Nothing is sent to a server, and the tool keeps working if you go offline after the page loads.
What is a file fingerprint or hash?
A hash such as SHA-256 is a short code calculated from every byte of a file. Change a single byte and the code changes completely, so two files with the same SHA-256 have the same contents.
How do I verify a download with a checksum?
Copy the SHA-256 checksum from the official download page, paste it into “Expected hash”, then drop the downloaded file in. A green match means the file arrived intact and unmodified.
Can it handle very large files?
Yes. Files are hashed in 4 MB chunks, so a multi-gigabyte video or disk image never has to fit in memory. Speed depends on your device and disk, and the progress bar shows how far along it is.
Should I use SHA-256, SHA-1 or MD5?
Use SHA-256. MD5 and SHA-1 are offered only to check older checksums; both have known collision attacks and should not be trusted to prove a file has not been tampered with.
How do I check whether two files are identical?
Switch to “Compare two files” and drop one file on each side. If both SHA-256 fingerprints match, the files are identical byte for byte, even if their names or dates differ.
What does the timestamp certificate prove?
That a file with exactly this SHA-256 existed no later than the time of the Bitcoin block that includes it. It does not prove who made the file, that it did not exist earlier, or that its contents are true, and it is not a notarisation.
Is my file sent anywhere when I timestamp it?
No. Your browser adds a random salt to the file’s SHA-256, hashes it again and sends only that 32-byte value to public OpenTimestamps calendars. It reveals nothing about the file, not even its fingerprint.
Why does my timestamp say pending?
Calendars bundle many stamps into one Bitcoin transaction, which takes a few hours to be mined. Until then the proof holds the calendars’ promise. Drop the .ots proof into “Verify a timestamp” later to upgrade it to the full Bitcoin proof, and download the upgraded file.
How can someone else check my timestamp without trusting you?
Give them the original file and the .ots proof. They can check it here, at opentimestamps.org, or with the open-source ots command-line client, which reads the Bitcoin blockchain directly.
How do I get a SHA-256 hash on the command line instead?
On Windows run “certutil -hashfile file.zip SHA256” or “Get-FileHash file.zip” in PowerShell. On macOS run “shasum -a 256 file.zip”, and on Linux “sha256sum file.zip”. The results match this tool.