API reference

Verify a checksum

Check data against an expected hash or a checksum list.

GET POST /api/hash/verify MCP tool hash_verify

Hashes the data with every algorithm whose digest length matches the expected hash (for 64 hex digits: SHA-256, SHA3-256 and BLAKE3) and reports whether any matches. expected may be hex, Base64, SRI (sha384-…), prefixed (sha256:…), or a whole GNU/BSD checksum file, in which case the line for filename (or the uploaded file name) is used. A mismatch is a successful response with match: false.

Browser version (runs locally): File Hash Verification.

Try it
Credentials
Remember these credentials

Not saved: you will paste them again next time.

No credentials yet? Get a client ID and secret. They are sent only to this site, in an Authorization: Basic header.

POST /api/hash/verify with a JSON body

Parameters

Parameter Type Default Description
input string — Data as UTF-8 text. Use exactly one of input, input_base64, or a file upload.
input_base64 string — Data as Base64 (either alphabet), for binary content over JSON or MCP.
expected required string — Expected hash in any supported form, or the contents of a checksum file.
filename string — Which checksum-list line to use. Defaults to the uploaded file name. Directory parts are ignored.

Also accepted on every endpoint: format (json | text). Parameters may come from the query string, a JSON object body, an urlencoded or multipart form, or (for input) a text/plain body. Binary data can be uploaded as a multipart file field or an application/octet-stream body.

Global parameters
Parameter Type Default Description
format json | text json json returns the documented object. text returns only the primary value as text/plain (see "Text output").

Response 200 application/json

Field Type Description
match boolean True when a computed digest equals the expected hash.
algorithm string | null Algorithm ID that matched, or null.
expected string Expected digest normalised to lowercase hex.
actual map of string Computed digest for each candidate algorithm.
filename string | null File name used to select a checksum-list line.
bytes integer Length of the data in bytes.

Text output (format=text, text/plain): OK <algorithm> or MISMATCH.

Errors

Errors are JSON: {"error": "<message>", "code": "<code>", "param": "<name>"?}.

Status Code When
422 unprocessable_input expected is not a recognisable hash, or a checksum list has no line for the file.
400 missing_parameter A required parameter is absent.
400 unknown_parameter A parameter name is not in the table above (typos are rejected, not ignored).
400 invalid_parameter A value has the wrong type, is out of range, or is not an allowed value.
413 payload_too_large The request body exceeds 1 MiB.
405 method_not_allowed A method other than GET, POST or OPTIONS.

Behaviour

  • Idempotent: the same arguments always return the same result.
  • Requires a client ID and secret (authentication). Each call is recorded as one metadata row against your client ID; inputs and outputs are never stored or logged. Responses carry cache-control: no-store.
  • CORS: any origin may call this endpoint from a browser, using your credentials.

Examples

Responses below were produced by running each request through this code at build time. Long strings are shortened.

Match against a hex SHA-256

curl 'https://util.caruana.me/api/hash/verify?input=abc&expected=ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'

Response 200

{
  "match": true,
  "algorithm": "sha256",
  "expected": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
  "actual": {
    "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
    "sha3-256": "3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532",
    "blake3": "6437b3ac38465133ffb63b75273a8db548c558465d79db03fd359c6cd5bd9d85"
  },
  "filename": null,
  "bytes": 3
}
Same call as an MCP tools/call
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "hash_verify",
    "arguments": {
      "input": "abc",
      "expected": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
    }
  }
}

Use a SHA256SUMS line by filename

curl -X POST 'https://util.caruana.me/api/hash/verify' \
  -H 'content-type: application/json' \
  -d '{"input":"abc","filename":"b.txt","expected":"900150983cd24fb0d6963f7d28e17f72  a.txt\nba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad  b.txt"}'

Response 200

{
  "match": true,
  "algorithm": "sha256",
  "expected": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
  "actual": {
    "sha256": "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
    "sha3-256": "3a985da74fe225b2045c172d6bd390bd855f086e3e9d525b46bfe24511431532",
    "blake3": "6437b3ac38465133ffb63b75273a8db548c558465d79db03fd359c6cd5bd9d85"
  },
  "filename": "b.txt",
  "bytes": 3
}
Same call as an MCP tools/call
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "hash_verify",
    "arguments": {
      "input": "abc",
      "filename": "b.txt",
      "expected": "900150983cd24fb0d6963f7d28e17f72  a.txt\nba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad  b.txt"
    }
  }
}