How to Verify File Integrity with Checksums

A checksum (or hash) is a fixed-length string generated from a file's contents using a hashing algorithm. Its job is narrow but useful: confirm that a file hasn't been corrupted or altered since the hash was generated. If even a single bit of the file changes, the resulting hash changes completely and unpredictably — this is known as the avalanche effect.

What a checksum does not do on its own is prove who created the file or that it's safe to run — it only proves the file matches the exact bytes the hash was generated from.

A cryptographic hash function takes an input of any size and produces a fixed-length output — for example, SHA-256 always produces a 256-bit (64 hex character) output, whether you hash one byte or ten gigabytes. Three properties matter for integrity checking:

• Deterministic — the same input always produces exactly the same output.
• One-way — you cannot feasibly reconstruct the original input from the hash alone.
• Collision-resistant (for strong algorithms) — it should be computationally infeasible to find two different inputs that produce the same hash.

MD5 and SHA-1 are both considered cryptographically broken — practical collision attacks exist for both, meaning a motivated attacker can craft two different files that produce the same hash. They're still commonly seen for basic accidental-corruption checks (confirming a download wasn't truncated or damaged in transit) but should not be trusted for anything where an adversary might deliberately try to fake a match.

SHA-256 is the current practical standard for security-sensitive verification — software downloads, checksums published alongside releases, and most modern security tooling. No practical collision attack is known against it.

SHA-512 offers a larger output and a similar security margin to SHA-256, with a small performance difference depending on the platform (SHA-512 can actually be faster on 64-bit hardware despite the longer output).

Generate any of these instantly with the Hash and Checksum Generator, from text or from a file directly in your browser.

Say a vendor publishes a software download alongside this line:

After downloading the file, generate its SHA-256 hash yourself and compare it character-by-character against the published value. An exact match confirms the file downloaded completely and wasn't corrupted or altered in transit. Any difference — even a single character — means something changed, and the file should not be trusted or run until re-downloaded from a verified source.

A checksum only proves the file matches the bytes the hash was generated from — it says nothing about whether the source publishing that hash is trustworthy in the first place. If an attacker compromises the download page itself, they can publish a malicious file alongside a matching malicious hash, and the checksum will "verify" perfectly.

For genuine authenticity — proving a file actually came from who it claims to be from, not just that it matches a given hash — you need code signing (a cryptographic signature tied to a verified publisher identity) or PGP/GPG signing, which checksums alone don't provide.