Hash generator · Guide
MD5 Hash a File: Checksums from the Command Line and the Browser
Hashing a file gives you a 32-character fingerprint of its exact bytes. It is the fastest way to tell whether two copies are identical, or whether a download finished intact. Here are the commands on every platform, plus the reasons a checksum comes out wrong.
The command on each platform
Every operating system ships a tool. They print the same digest for the same bytes, only the output format differs:
md5sum archive.tar.gz # Linux
md5 -q archive.tar.gz # macOS
Get-FileHash archive.zip -Algorithm MD5 # Windows PowerShell
certutil -hashfile archive.zip MD5 # Windows, olderOn Windows, Get-FileHash prints uppercase hex and certutil inserts spaces. Both are the same value — compare case-insensitively and strip whitespace before you judge a mismatch.
Hashing a file in the browser
Our generator reads the file with the browser FileReader API and hashes it locally. Nothing is uploaded, which is what makes it usable for an internal build artifact or a customer export.
The digest matches the command line exactly, because both read the raw bytes with no newline translation and no trimming. The practical ceiling is memory: files past a few tens of megabytes are better handled by md5sum.
Verifying many files at once
Checksum files let you record and re-check a whole directory. This is how most Linux distributions publish their releases:
# record digests for every ISO in the folder
md5sum *.iso > MD5SUMS
# later, verify them all
md5sum -c MD5SUMSmd5sum -c prints OK per file and exits non-zero if any digest differs, which makes it usable directly in a CI script.
When the checksum does not match
In order of likelihood: the download is incomplete, you hashed a different file than you think, the publisher listed SHA-256 while you computed MD5, or the file was transferred in text mode by an old FTP client and had its line endings rewritten.
Compare byte sizes first — that catches a truncated download in a second and costs nothing. And remember what a match actually proves: the bytes are unchanged. If an attacker controlled both the file and the published checksum, MD5 will happily confirm a forgery, which is why security-sensitive verification belongs on SHA-256.
Frequently asked questions
Does hashing modify the file?
No. Hashing only reads the bytes; the file is untouched.
Why does the same file give a different digest on another machine?
The bytes differ somewhere. The usual culprits are line-ending conversion during transfer or an incomplete copy.
Is MD5 good enough for verifying downloads?
For accidental corruption, yes. For protection against a deliberate swap, no — use SHA-256.
Ready to try it?
Open the free browser-based Hash generator and apply what you just read — no sign-up, runs locally.
Open the Hash generator tool