Contact

Tools  /  Security  /  SHA File Checker

SECURITY

SHA File Checker

Batch-verifies an entire folder of downloaded files against a multi-line checksum manifest at once -- matched by filename, with per-algorithm auto-detection and a pass/fail report you can export.

More Security tools

Hash Generator Password Generator JWT Decoder & Generator HMAC Generator Hash Identifier Random Token Generator

What this tool does

Verifies a whole batch of files at once against a multi-line checksum manifest -- drop in every file from a download alongside the CHECKSUMS.txt (or similar) the publisher provided, and each file is matched to its manifest line by filename, hashed, and checked -- producing a single pass/fail report instead of checking files one at a time. This is a focused, batch-verification companion to this site's File Hash Calculator (hash one file in six algorithms side by side) and Checksum Calculator (auto- detects SRI/npm/pip/Docker/sha256sum formats for a single checksum string).

Why batch verification matters

Software that ships as multiple files -- an SDK, a multi-file release archive extracted into separate pieces, a dataset split across several downloads -- is only as trustworthy as its least-verified file. Checking files one at a time by hand doesn't scale and is easy to get partway through and stop. Matching every file against its manifest entry in one pass makes it obvious at a glance whether anything is missing, tampered with, or simply wasn't checked yet.

Why checksum verification is still worth doing

A checksum doesn't prove a file is safe -- it proves the bytes you received match the bytes the publisher intended, nothing more. That's still valuable: it catches corrupted downloads, partial transfers, and CDN or mirror inconsistencies, and -- when the checksum itself was obtained over a trusted channel separate from the file's own download -- it catches tampering too. Supply-chain compromises that swap a malicious file in for a legitimate one at some point in the distribution chain are exactly the scenario a verified, independently-sourced checksum is meant to catch.

Which algorithm to trust

This tool auto-detects SHA-1, SHA-256, SHA-384, and SHA-512 per manifest line by hash length, for compatibility with whatever a given manifest uses. For anything where the checksum is actually doing security work (not just corruption detection), prefer manifests published in SHA-256 or stronger -- SHA-1 has a practical collision attack (SHAttered) and should only be trusted here for legacy compatibility, never as a security guarantee on its own.

Privacy

Everything runs entirely in your browser via the native Web Crypto API. Nothing you upload or paste here is sent anywhere.

FAQ

Frequently asked questions

How does batch verification match files to the manifest?
By filename -- each uploaded file is looked up against the manifest's filename column. Files with no matching manifest line, and manifest lines with no matching uploaded file, are both clearly flagged rather than silently ignored.
What manifest format does it expect?
The standard sha256sum/shasum output format: one line per file, a hex hash, whitespace, then the filename (optionally prefixed with *). SHA-1, SHA-256, SHA-384, and SHA-512 are all auto-detected per line by hash length.
Does a matching checksum prove a file is safe?
No -- it proves the bytes match what the manifest says they should be, nothing about whether the file is malicious. It's most meaningful when the checksum came from a source independent of the file download itself, so a compromised download can't also carry a matching fake checksum.
Should I trust a SHA-1 checksum?
Only for legacy compatibility or non-adversarial corruption checks, not as a real security guarantee -- SHA-1 has a practical collision attack (SHAttered). Prefer SHA-256 or stronger wherever the publisher offers it.
How is this different from the File Hash Calculator?
The File Hash Calculator hashes one file at a time across six algorithms for comparison. This tool is built around batch verification -- many files matched against a manifest in one pass, with a pass/fail report, rather than one file's hash at a time.
Can I export the verification results?
Yes -- the Batch Verify tab's report can be copied as plain text summarizing every file's status, useful as a record that a given set of files was checked.
Is anything I upload here sent anywhere?
No. Every hash and comparison runs entirely in your browser using the native Web Crypto API -- this tool has no server component.
Theme Accent