File Integrity Manifest Generator

Build a SHA-256 or SHA-512 manifest for a whole folder of files, then re-verify it later to see exactly what changed, was added or went missing.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop files or a folder

Up to 500 files, 256 MB each. Hashed in your browser.

Algorithm

Existing manifest to check against (optional) GNU coreutils or BSD format. Leave blank to just generate one.

A comparison has three outcomes, not two

Checking a set of files against a manifest is usually presented as pass or fail. It is not. There are three things that can be wrong, and only two of them get reported by tools that count matches:

Changed - a file is present and its contents differ.
Missing - a file in the manifest is not there.
Not in the manifest - a file is there that the manifest never mentioned.

The third is the one that gets dropped, and it is the one that matters most: an added file is how most things arrive on a system that should not be there. "47 of 47 files matched" is a perfectly true statement about a directory that has gained a web shell. All three are counted separately here.

What a manifest is and is not evidence of

A manifest proves files have not changed since the manifest was made. It says nothing about whether they were correct at that moment - hashing a compromised directory produces a perfectly valid manifest of compromised files.

It is also only as trustworthy as wherever you keep it. A manifest stored alongside the files it describes protects against accidental change, not against anyone who can edit both. For that, keep it somewhere the files' owner cannot reach - a different system, a signed commit, a write-once log.

Formats

Output is the GNU coreutils format, <hash> path, which sha256sum -c reads directly, plus a JSON version carrying sizes as well. Input accepts both that and the BSD SHA256 (path) = <hash> style, and matches paths across Windows and Unix separators so a manifest made on one checks on the other.

Everything stays local

Choosing a folder gives the browser every file inside it, all of which are hashed in the page. None is uploaded.

Frequently asked questions

Can I hash a whole folder?

Yes - the file chooser accepts a directory, and relative paths are preserved in the manifest so it can be checked from the same root later.

Will sha256sum read my manifest?

Yes. The text output is the standard coreutils format, so sha256sum -c manifest.txt works directly.

Why does it say files are missing when I checked the same folder?

Usually because the manifest was made from a different root, so the paths do not line up. The page matches across path separators but not across different base directories.

How is this different from the checksum verifier?

That page checks one file against one published value. This one covers a set of files and answers a different question - what changed since last time.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.