VERIFY A WHOLE DELIVERY

Checksum Manifest Verifier

Create or verify SHA-256, SHA-384 and SHA-512 manifests for a batch of files. Find missing, changed and extra files without uploading their contents.

1. Files & expected checksums

Choose filesOr choose a folder (preserve relative paths)

No files selected.

WorkflowAlgorithm

Remove one common top-level folder

Expected manifest (verification only)Open text or ToolSorcerer JSON manifest

1–200 files · 100 MiB per file · 500 MiB per batch · 2,000 expected entries · two-minute job limit. Files are hashed sequentially in a local worker.

2. Compare & export

Choose files, or try the sample verification.

“Actual” exports describe the selected files, including extra or mismatching files. They do not replace the expected manifest automatically.

Relative path	Result	Actual bytes	Actual digest (expected if missing)

Checksums establish equality with an expected value, not trust or malware safety. Obtain expected manifests from a trusted independent source.

How to verify a delivery

Choose the delivered files or a folder. Folder selection preserves paths; remove one common root folder only if needed to match your manifest.
Choose the same hash algorithm as the expected manifest, then paste or open it and select Verify.
Run, review every match/mismatch/missing/extra result, and download the verification report.

Supported manifest syntax

Plain text uses a hex digest followed by two spaces and a relative filename, or a space plus * and the filename. Blank lines and # comments are ignored. GNU escaped filenames, absolute paths, parent traversal and duplicate normalized paths are rejected. Paths are case-sensitive, with backslashes normalized to slashes. JSON accepts version 1 ToolSorcerer manifests from this page.

Empty files are valid inputs. An empty folder contains no bytes to hash and cannot be represented in a file-checksum manifest. This tool never deletes or modifies selected files.

Using Checksum Manifest Verifier

Verify delivered files against trusted expected checksums, or create a manifest for your own batch.

Select files or a folder and align relative paths.
Choose the algorithm, load expected checksums and run verification.
Review all statuses and download the verification report or a new actual-file manifest.

Example

The sample includes abc with a known SHA-256 checksum, a missing expected file and an extra selected file.

Questions & answers

What manifests can I open?

Plain text hex-digest entries with two spaces or a space and * before the filename, and version 1 ToolSorcerer JSON manifests. GNU backslash-escaped filenames and other formats are not supported.

What are the limits?

Up to 200 selected files, 100 MiB each, 500 MiB total, 2,000 expected manifest entries and 256,000 manifest characters. Jobs stop after two minutes.

How are paths compared?

Relative paths are case-sensitive, backslashes become slashes and duplicate normalized names are rejected. You can explicitly remove one common leading folder. Absolute paths and parent traversal are not accepted.

Does a matching checksum mean a file is safe?

No. It proves equality with the supplied checksum, not that either source is trustworthy. Obtain expected checksums independently from a trusted source.

What do the exports contain?

The verification report contains matches, mismatches, missing and extra files. Actual manifest exports describe only selected files and do not silently overwrite the expected manifest.