Skip to content
Security & Privacy

PDF Checksum: SHA-256, SHA-1 & MD5

Get a PDF checksum online to prove a file is exactly the one you sent or signed. The SHA-256 fingerprint changes if even one byte does — and it’s computed on your device.

Settings appear once you add a PDF.

Done on your device No upload, no queue, no sign-up.

Bytes sent anywhere: 0 B

How to get a PDF checksum online

Your file goes into this browser tab, is fingerprinted on your device, and comes back as its SHA-256, SHA-1 and MD5. 0 bytes uploaded

  1. Add your PDFs

    Drop one PDF or many.

  2. Check the settings

    SHA-256, SHA-1 and MD5 appear straight away. Paste a published value to check it matches.

  3. Save the result

    Save a checksums file to send along with the PDFs, in the standard sha256sum format.

Why it doesn’t upload

A checksum proves a file hasn’t been tampered with — which only means something if the file wasn’t handed to a third party to compute it. The fingerprints here are calculated in your browser from the bytes on your disk.

Check it in your browser’s Network tab

Worth knowing

  • A checksum proves two files are identical; it doesn’t say who made the file. For that you need a digital signature.
  • Any change — even re-saving without edits — produces a different checksum.
  • MD5 and SHA-1 are fine for spotting accidental changes but not for proving nobody tampered deliberately. Use SHA-256 for that.

Under the hood

What happens to your file

SHA-256 and SHA-1 are computed by your browser’s Web Crypto API, the same implementation it uses for HTTPS; MD5, which Web Crypto leaves out on purpose, is computed in plain JavaScript following RFC 1321. The file is read, not changed: the same file always gives the same fingerprints.

Runs on Web Crypto

Reference: NIST FIPS 180-4 (SHA) · RFC 1321 (MD5)

Questions

What is a PDF checksum?

A short fingerprint calculated from every byte of the file. If anything in the PDF changes — a single character, a byte of metadata — the checksum changes completely.

How do I verify a PDF hasn’t been changed?

Drop it here and paste the checksum you were given into Compare. A green match means the file is byte-for-byte identical to the original.

Which checksum should I use?

SHA-256. It’s the standard for proving integrity. MD5 and SHA-1 are shown because older systems still publish them.

Does the file name affect the checksum?

No — only the contents. Renaming a PDF doesn’t change its checksum; re-saving it does.

Read more about this

More security & privacy tools

All security & privacy tools