Log In Get Started
Free tool

File checksum

A swapped file looks like the real one: same name, same size, same icon. The only way to tell them apart is the checksum, a short fingerprint of the contents. Drop the file in, compare the sum with the one its author published: a match means this is the file, a mismatch means it is a different file.

Computed in the browser: the file is not uploaded anywhere.

Drop a file here or

The file is read inside the tab. SHA-256 is computed; SHA-1 and SHA-512 are behind the button next to the result.

How to check our apps

Next to every download on the site there is a file with the reference sum: 404vpn.apk.sha256, tunnel.apk.sha256 and 404vpn-macos.dmg.sha256. Open the one you need, copy the line into the field above, drop in the downloaded file, the page will say whether it matched.

This is also the answer to "was I handed a fake APK". Android will not show any difference between our file and someone else’s with the same name; the checksum will.

One limit

The sum is computed over the whole file, and for that the whole file goes into the memory of the tab. A few hundred megabytes the browser takes calmly; a disk image of tens of gigabytes it does not. For files like that the command line is safer: shasum -a 256 file on macOS and Linux, certutil -hashfile file SHA256 on Windows.

Downloaded our app?

Check the sum and make sure you have our file, not someone’s repack with the same name.

404 VPN downloads →

FAQ

guest@404vpn:~$ cat file-hash-faq.md
[01] $ Why compare sums if the file came from the official site? ▸
> Because there is a road between the site and your disk: a file can be swapped by an infected router, by a carrier that injects ads, by public Wi-Fi, or by a mirror that "just downloads faster". HTTPS protects against a lot, but not against the case where you downloaded from a different address believing it was the same one. The checksum answers the question outright.
[02] $ Which sum is the right one, and where do I get it? ▸
> From the author of the file. Next to every download of ours we publish a file with a .sha256 extension, the reference lives there. Importantly, take the reference from a source you trust, not from the same place you got the suspicious file. Otherwise both the file and the sum beside it can be forged.
[03] $ The sum did not match, what does that mean? ▸
> That this is not that file. The reasons can be harmless: you downloaded a different version, the download broke off and the file is incomplete, the archive was repacked. But treat it the other way round: until the sum matches, consider the file a stranger and do not run it.
[04] $ Why SHA-256 and not MD5? ▸
> MD5 has long been broken: finding a second file with the same sum takes minutes on an ordinary computer today, and that is exactly how fakes get slipped in. It is no good for checking authenticity. SHA-1 holds up slightly better but is also considered unfit; we offer it only for old files where no other sum was ever published.
[05] $ Is the file really not sent anywhere? ▸
> Really: the page reads it in the memory of the tab and computes the sum with WebCrypto built into the browser. No network requests happen at all, you can see that in the Network tab of the developer tools. Sending a file to someone else’s server to check whether it was swapped would be a strange idea.