Skip to content
Security & Privacy

PDF Checksum: SHA-256, SHA-1 & MD5

Get a PDF checksum online to prove a file is exactly the one you sent or signed. The SHA-256 fingerprint changes if even one byte does — and it’s computed on your device.

PDF Checksum

Settings appear once you add a PDF.

Ctrl + Enter runs it ·

Bytes sent anywhere: 0 B

Keyboard shortcuts

Ctrl K
Search all tools
Ctrl V
Paste files to add them
Ctrl Enter
Run the tool
?
Show this list
Esc
Close this list or the search
  • 100% private Your PDFs never leave this device. Everything runs in your browser.
  • No limits No file-size cap, no watermark, no sign-up and no daily quota. Free.
  • Batch ready Add as many PDFs as you like; each one is handled and saved in one go.

How to get a PDF checksum online

  1. Add your PDFs: Drop one PDF or many.

  2. Check the settings: SHA-256, SHA-1 and MD5 appear straight away. Paste a published value to check it matches.

  3. Save the result: Save a checksums file to send along with the PDFs, in the standard sha256sum format.

Why it doesn’t upload

A checksum proves a file hasn’t been tampered with — which only means something if the file wasn’t handed to a third party to compute it. The fingerprints here are calculated in your browser from the bytes on your disk.

Check it in your browser’s Network tab

Worth knowing

  • A checksum proves two files are identical; it doesn’t say who made the file. For that you need a digital signature.
  • Any change — even re-saving without edits — produces a different checksum.
  • MD5 and SHA-1 are fine for spotting accidental changes but not for proving nobody tampered deliberately. Use SHA-256 for that.

Under the hood

What happens to your file

SHA-256 and SHA-1 are computed by your browser’s Web Crypto API, the same implementation it uses for HTTPS; MD5, which Web Crypto leaves out on purpose, is computed in plain JavaScript following RFC 1321. The file is read, not changed: the same file always gives the same fingerprints.

Runs on Web Crypto

Reference: NIST FIPS 180-4 (SHA) · RFC 1321 (MD5)

Why check a PDF’s checksum?

A checksum is a fingerprint of a file’s exact bytes. Change one byte — an edited figure, a swapped page, a re-save — and the SHA-256 value changes completely. Comparing fingerprints is how you prove that the contract you received is the one that was sent, or that a download wasn’t corrupted on the way.

The fingerprint is computed in your browser, so you can check confidential files without uploading them anywhere.

When to verify a PDF with a hash

  • Confirming a contract wasn’t altered

    Compare the SHA-256 of the copy you hold with the one the other side recorded — how to prove a PDF hasn’t been changed.

  • Legal and evidence handling

    Record a document’s hash when you receive it, so you can show later that it hasn’t changed.

  • Checking a download

    Many publishers list a checksum next to a file; matching it confirms a complete, untampered download.

  • Tracking versions

    Two files with the same name but different hashes are different versions — no guessing.

  • Archiving

    Store hashes alongside archived PDFs to detect silent corruption years later.

Tips for using PDF checksums

  1. Use SHA-256 to prove nobody tampered with a file; MD5 and SHA-1 are fine only for spotting accidental changes.
  2. Paste the checksum you were given into the compare box to get a match or no-match answer instead of comparing by eye.
  3. Re-saving a PDF without edits still changes its checksum. Hash the exact file that was sent.
  4. A checksum shows two files are identical, not who made them. For authorship, a digital signature is needed.
  5. Note the hash somewhere separate from the file, or it can be replaced along with it.

Questions

What is a PDF checksum?

A short fingerprint calculated from every byte of the file. If anything in the PDF changes — a single character, a byte of metadata — the checksum changes completely.

How do I verify a PDF hasn’t been changed?

Drop it here and paste the checksum you were given into Compare. A green match means the file is byte-for-byte identical to the original.

Which checksum should I use?

SHA-256. It’s the standard for proving integrity. MD5 and SHA-1 are shown because older systems still publish them.

Does the file name affect the checksum?

No — only the contents. Renaming a PDF doesn’t change its checksum; re-saving it does.

Read more about this

More security & privacy tools

All security & privacy tools