Log In Get Started
Free tool

File checksum

A swapped file looks like the real one: same name, same size, same icon. The only way to tell them apart is the checksum — a short fingerprint of the contents. Drop the file in, compare the sum with the one its author published: a match means this is the file, a mismatch means it is a different file.

Computed in the browser: the file is not uploaded anywhere.

Drop a file here or

The file is read inside the tab. SHA-256 is computed; SHA-1 and SHA-512 are behind the button next to the result.

How to check our apps

Next to every download on the site there is a file with the reference sum: 404vpn.apk.sha256, tunnel.apk.sha256 и 404vpn-macos.dmg.sha256. Open the one you need, copy the line into the field above, drop in the downloaded file — the page will say whether it matched.

This is also the answer to "was I handed a fake APK". Android will not show any difference between our file and someone else’s with the same name; the checksum will.

One limit

The sum is computed over the whole file, and for that the whole file goes into the memory of the tab. A few hundred megabytes the browser takes calmly; a disk image of tens of gigabytes it does not. For files like that the command line is safer: shasum -a 256 file on macOS and Linux, certutil -hashfile file SHA256 on Windows.

Downloaded our app?

Check the sum and make sure you have our file, not someone’s repack with the same name.

404 VPN downloads →

FAQ

guest@404vpn:~$ cat file-hash-faq.md
[01] $ Why compare sums if the file came from the official site? ▸
> Because there is a road between the site and your disk: a file can be swapped by an infected router, by a carrier that injects ads, by public Wi-Fi, or by a mirror that "just downloads faster". HTTPS protects against a lot, but not against the case where you downloaded from a different address believing it was the same one. The checksum answers the question outright.
[02] $ Which sum is the right one, and where do I get it? ▸
> From the author of the file. Next to every download of ours we publish a file with a .sha256 extension — the reference lives there. Importantly, take the reference from a source you trust, not from the same place you got the suspicious file. Otherwise both the file and the sum beside it can be forged.
[03] $ The sum did not match — what does that mean? ▸
> That this is not that file. The reasons can be harmless: you downloaded a different version, the download broke off and the file is incomplete, the archive was repacked. But treat it the other way round: until the sum matches, consider the file a stranger and do not run it.
[04] $ Why SHA-256 and not MD5? ▸
> MD5 has long been broken: finding a second file with the same sum takes minutes on an ordinary computer today, and that is exactly how fakes get slipped in. It is no good for checking authenticity. SHA-1 holds up slightly better but is also considered unfit; we offer it only for old files where no other sum was ever published.
[05] $ Is the file really not sent anywhere? ▸
> Really: the page reads it in the memory of the tab and computes the sum with WebCrypto built into the browser. No network requests happen at all — you can see that in the Network tab of the developer tools. Sending a file to someone else’s server to check whether it was swapped would be a strange idea.