Tidy My Mac
Free tool
File checksum checker
Choose a file you downloaded to get its SHA-256, SHA-1 and SHA-512 checksums, and compare them with the one its publisher lists. The file is read in your browser and never uploaded.
What a checksum tells you
A checksum is a short fingerprint worked out from every byte of a file. Change a single byte and the fingerprint changes completely. When a publisher lists the SHA-256 of a download and yours is the same, your copy is byte for byte the file they released: it wasn't cut short on the way, and nobody swapped it for something else.
It only proves the file matches the checksum. If the checksum comes from the same hacked page as the download, both can be fake, so take it from the publisher's own site, over https.
SHA-256, SHA-1 or SHA-512?
Use whichever the publisher lists; SHA-256 is the usual one. SHA-1 is still fine for spotting a damaged download, but it is no longer safe against someone who forges a file on purpose, so prefer SHA-256 or SHA-512 when both are offered.
Checksums on your Mac
Terminal does the same without a browser, for files of any size: type shasum -a 256 and a space, drag the file into the window and press Return. For apps, macOS checks more than a checksum: the developer's signature and Apple's notarization. Tidy My Mac's App Signatures page shows which of your installed apps are unsigned or have been changed since they were signed.
Questions about checksums
No. Your browser reads the file and works out the checksums on your Mac. Nothing about the file, not even its name, is sent to us.
Don't open the file. Most often the download was interrupted, so delete it and download it again from the publisher's own site. If it still doesn't match, check that you are comparing with the checksum for the same version and the same file, and tell the publisher.
It means the file is the one the publisher released, not that the publisher is trustworthy. Malware has a checksum too. Download from sources you trust, and let an antivirus scan what you download.
More free security tools
Website scam checker
Type a site or paste a link: our scam and phishing lists, the domain's age and look-alike names.
Open the tool →Scam message checker
Paste an email, text or DM: the scam signs in it, and its links checked against our lists.
Open the tool →Password checker
Has a password leaked in a data breach, and how long would it take to crack? It never leaves your browser.
Open the tool →Password generator
Random passwords and passphrases, made in your browser with the length and characters you choose.
Open the tool →Link cleaner
Strip utm, fbclid and other tracking from a link, and see where a redirect link really leads.
Open the tool →Text encryption
Lock a note or a password with AES-256 before you send it, and unlock it here. Nothing leaves your browser.
Open the tool →Base64 encoder and decoder
Encode text to Base64 or decode it back, URL-safe alphabet included. Nothing leaves your browser.
Open the tool →Username generator
Random usernames that say nothing about you, so your accounts can't be linked together.
Open the tool →Email header analyzer
Paste an email's headers: SPF, DKIM and DMARC, the real sender, and where replies would go.
Open the tool →Mac app vulnerability checker
Is your version of Chrome, Firefox, VLC or another app safe? Known holes and the version that fixes them.
Open the tool →Report a harmful site
Found a phishing page, fake shop or scam site? Report it and we'll review it for our lists.
Open the tool →“Apple could not verify” an app is free of malware: what it means
Why Gatekeeper blocked the app, whether to trust it, and how to open it anyway.
Read the guide →How to remove malware from a Mac, step by step
The signs, the places malware hides, and what to do if a password stealer ran.
Read the guide →Scan your Mac for malware, free for 7 days.
Just your email, no credit card. Then $19.99 for your first year, $59.99 a year after that.
Scan your Mac free