Developer · Validation
IPFS CID validator & inspector.
Paste a CIDv0 or CIDv1 to check that its structure is well formed and see its version, multibase encoding, codec, hash function and digest length. Everything runs in your browser: nothing you type is transmitted anywhere, and no network lookup is made.
Inputs
Result
Enter a CID and press Inspect.
How a CID is put together
A CID (Content Identifier) is a self-describing content address. A CIDv0 is 46 characters starting “Qm”: the base58btc encoding of a bare multihash, always 0x12 0x20 followed by a 32-byte SHA-256 digest (34 bytes), with the dag-pb codec implied. A CIDv1 starts with a one-character multibase prefix (for example b for base32, z for base58btc, f for hex). The rest decodes to bytes made of unsigned varints: the version (1), the multicodec that says how to read the content (for example 0x70 dag-pb, 0x55 raw, 0x71 dag-cbor), then a multihash: a hash-function code, the digest length, and the digest itself.
This tool follows the decoding algorithm in the multiformats CID specification. A binary CID whose first byte is 0x12 behind a multibase prefix is rejected, versions 2 and 3 are reserved, the digest must fill the remaining bytes exactly, and varints must be minimally encoded. If a hash function is known but the digest length is unusual for it, the result is still shown with a warning. The IPFS documentation example QmbWqxBEKC3P8tqsKc98xmWNzrzDtRLMiMPL8wBuTGsMnR and bafybeigdyrzt5sfp7udm7hu76uh7y26nf3efuylqabf3oclgtqy55fbzdi wrap the same SHA-256 digest.
Sources: multiformats/cid, multiformats/multibase, multiformats/multihash, unsigned-varint, multicodec table, cross-checked against js-multiformats.
What a well-formed CID does and doesn’t tell you
This tool checks structure only. A CID has no check digit, so a well-formed result does not confirm that any content exists on IPFS, that the digest matches any particular file, or who published it. Only a supported set of multibase encodings (base2, 8, 10, 16, 32, 32hex, 32z, 36, 58btc, 58flickr, 64, 64url) and the most common codecs and hash functions are recognised; others are flagged rather than guessed. It runs entirely in your browser: nothing you type is transmitted, stored, or logged.