The workshop · Fingerprint of a file
How it works : Fingerprint of a file
Drop any file in and its fingerprint appears. Paste the one the download site publishes, and the tool tells you whether the two match, character by character.
A fingerprint is a string of sixty-four characters computed from the contents of a file. Change a single byte in the file and the fingerprint changes completely. That is what lets you answer one precise question: is the file I received exactly the one that was meant for me?
Serious projects publish the fingerprint of their files next to the download link, precisely so that you can check. A file damaged in transit, an interrupted download, a mirror serving an old version, or a file swapped out by someone: all four show up in the fingerprint.
What a fingerprint does NOT tell you: it does not tell you the file is safe. If you take the fingerprint from the same page as the file, and that page has been tampered with, the two will match and you will have verified nothing. A fingerprint proves the transport was faithful, not that the source is honest.
How it works
- Drop your file on the drop zone, or choose it. Any type of file will do: the tool reads bytes, it makes no attempt to understand the content.
- The SHA-256 fingerprint appears at once. The button copies it to your clipboard.
- To verify: paste the fingerprint published by the source into the field, and click “Compare”. The tool says whether the two match, and points at where they differ.
Formats accepted
This tool does not look at the contents of your file: it reads its bytes and hashes them. There is therefore no list of formats, and nothing that can go wrong because of one.
Any file at all
An image, an archive, an installer, a document, a video, a file you do not recognise: everything is hashed the same way. The four functions on offer are the ones the browser supplies itself, with no library involved.
Its limits
500 MB per file
The browser offers NO progressive hashing: you have to hand it the whole file at once, in memory, in a single contiguous block. That is a limit of the web's cryptography interface, verified, not a choice of ours. Beyond it, allocation fails and the tab dies.
MD5 is not offered
The browser cannot compute an MD5: that function is absent from its cryptography interface, and adding it would mean embedding a library. It is also a function that has been broken for twenty years for any security purpose. If a source publishes only an MD5, take that as a sign about the source.
SHA-1 is offered, but flagged as broken
Old projects still publish it, so you have to be able to compare it. But two different files with the same SHA-1 can now be manufactured: it no longer proves anything against someone acting in bad faith. It remains useful against plain transport errors.
A matching fingerprint does not prove the file is safe
It proves the file you received is identical to the one whose fingerprint you were given. If the fingerprint comes from the same page as the file and that page has been tampered with, the check is empty. Good practice is to take the fingerprint from a source independent of the file.
Questions about this tool
Is my file sent anywhere?
No, and you do not have to take our word for it. Open your browser's inspector with F12, go to the “Network” tab, clear the list, then drop your file in. Not one line appears. You can also cut your connection: the tool keeps working. That matters especially here: people usually compute a file's fingerprint precisely because they do not trust it.
What is a fingerprint actually for?
To answer one question: is this file identical, byte for byte, to the one whose fingerprint I was given? An interrupted download, a failing disk, a mirror serving an old version, a file swapped out in transit: all of those change the fingerprint. It says nothing about the content, the quality, or the safety of the file.
Why don't you offer MD5?
Because the browser cannot compute it: MD5 is absent from the web's cryptography interface, and adding it would mean embedding a library. More to the point, it has been broken since the 2000s: manufacturing two different files with the same MD5 is within reach of an ordinary computer. A source that publishes only an MD5 tells you a great deal about how seriously it takes this.
Why a 500 MB limit?
Because the browser's cryptography interface offers no progressive hashing: there is no function for feeding it a file piece by piece. You have to hand over the whole file at once, in a single block of memory. Past a certain point the allocation fails and the tab dies. To hash a file of several gigabytes, a tool installed on the machine is still the right answer, and the command already exists on all three systems.
The fingerprint matches. Is the file safe?
No, and this is the commonest confusion of all. A matching fingerprint proves the file has not changed between the moment the fingerprint was published and now. If the page publishing the fingerprint was tampered with at the same time as the file, the two match perfectly and you have verified nothing. That is why people look for the fingerprint somewhere other than the download page whenever they can.
Can two different files have the same SHA-256 fingerprint?
In theory yes, because there are more possible files than possible fingerprints. In practice nobody has ever managed to build two, and nobody expects it any time soon. For SHA-1 it has been done since 2017, which is why the tool warns you when you choose it.
My fingerprint is in capitals and yours is in lower case.
It is the same one. A fingerprint is written in hexadecimal, and letter case carries no meaning. The tool compares while ignoring case, spaces, line breaks and any file name stuck on the end, as found in the checksum files published beside downloads.
Drop any file in and its fingerprint appears. Paste the one the download site publishes, and the tool tells you whether the two match, character by character.
VerifyThe proof, step by stepThe network inspector check, explained one gesture at a time, with screenshots.
The cornerThe security cornerEncrypt a file, build a strong passphrase, check that a download has not been tampered with, strip the trackers from a link.