Inspect a File's Type, Size and Checksums
Drop in one or more files to learn what they really are. The tool compares the file's signature bytes with its extension, computes SHA-256, SHA-384, SHA-512 and SHA-1 checksums you can verify against a published value, and shows a hex dump of the first 256 bytes.
How to inspect a file
- Choose or drop up to 20 files of any type.
- Compare the detected type with the extension and browser-reported MIME type; a warning appears if they disagree.
- Wait for the checksums (progress is shown), then paste an expected hash into the verify box to confirm the download is intact.
- Expand the hex dump to inspect the file's first 256 bytes.
Supported formats
- Input
- Any file
- Maximum size
- 51200 MB per file (limited by your device's memory)
Why the extension can lie
A file's extension is just part of its name, and the MIME type your browser reports is derived from that name. The first bytes of most binary formats, however, contain a fixed signature — %PDF for PDFs, 89 50 4E 47 for PNG images, PK for ZIP-based files such as DOCX. Comparing the two reveals renamed or mislabelled files. To look inside a ZIP-based file, open it with the ZIP Extractor; to check pixel dimensions in bulk, use the Image Dimension Checker.
Benefits
- Confirms software downloads against the publisher's checksum without command-line tools.
- Catches files whose extension doesn't match their content, a common trick in phishing attachments.
- Hashing runs in a background thread with progress and cancel, so large files don't freeze the page.
Limitations
- Checksums are only computed for files up to 1 GB, because the browser's Web Crypto API needs the entire file in memory.
- Signature detection covers common document, image, audio, video and archive formats; text-based formats cannot be told apart reliably.
- Last-modified dates come from the browser and may reflect when the file was copied rather than created.
Privacy and security
Files are read locally: the first 256 bytes for type detection, and the whole file inside a Web Worker for hashing with the Web Crypto API. Nothing is uploaded, and file contents are discarded when you remove them or leave the page.
Read our privacy policy for details about the site as a whole.
Frequently asked questions
Which hash should I compare with?
Use whichever algorithm the publisher lists — most now publish SHA-256. Paste their value into the verify box; the matching algorithm is highlighted automatically, and letter case doesn't matter.
Is SHA-1 still safe to use?
Not for security. Practical SHA-1 collisions have been demonstrated, so two different files can share a SHA-1 hash. It is shown only for comparing with older checksum lists; prefer SHA-256 or stronger.
Why is my DOCX detected as a ZIP archive?
Office Open XML files (DOCX, XLSX, PPTX) and many others such as EPUB and APK are ZIP containers, so their signature is the ZIP signature. That is expected and not flagged as a mismatch.