Check that a download is exactly what its publisher released. Paste the checksum from the download page, add the file, and see whether they match. Your file never leaves this device.
For passwords, API keys or short strings. Text is hashed as UTF-8.
Copy the checksum from the publisher's download page or release notes and paste it in the box above. Then add your file. The checker works out which algorithm the hash uses from its length and tells you whether the file matches. If the publisher offers a checksum file such as SHA256SUMS, you can paste or open the whole file and check several downloads at once.
The file is not the one the publisher described. It may have been damaged or cut short while downloading, it may be a different version, or it may have been altered. Do not open it. Download it again from the official source and check again. If it still does not match, contact the publisher.
It proves the file is identical to the one the hash describes, nothing more. A hash is only as trustworthy as the place you got it: if a website is compromised, an attacker can change the file and the hash together. Prefer hashes from signed release notes or a separate channel, and keep the usual caution with programs from unknown sources.
They reliably catch accidental damage, but someone determined can create two different files with the same MD5 or SHA-1 hash. To check that a file has not been tampered with, use SHA-256 or stronger when the publisher offers it. CRC32 is only a quick error check.
The checker reads the first bytes of each file, which reveal its real type, and compares that with the file name. A program named “invoice.pdf”, or a script named “photo.jpg”, is a common trick to get people to open something harmful. Some legitimate files also differ, for example a photo saved with the wrong extension, so a difference is a reason to look closer rather than proof of anything.
Only the file's hash, and only if you click it. VirusTotal then shows whether a file with that hash has been scanned before. Your file is not uploaded. If VirusTotal has never seen the hash, that means nobody has submitted the file, not that it is safe.