Checksums and hashes explained
A checksum is a fingerprint of a file. Here is how it works, which algorithm to trust and how to use it to verify downloads.
Properties of a good hash
- The same input always gives the same hash.
- A tiny change in the input changes the whole hash.
- You cannot rebuild the file from its hash.
- It is practically impossible to find two files with the same hash.
Hash, checksum or signature?
| Term | What it proves |
|---|---|
| Checksum (CRC32) | The data was not damaged by accident |
| Cryptographic hash (SHA-256) | The file is identical to the one hashed |
| Digital signature (GPG, code signing) | The file comes from the person who holds the private key |
Why MD5 and SHA-1 are retired
Researchers can now create two different files with the same MD5 in seconds, and did the same for SHA-1 in 2017. An attacker could therefore swap a file while keeping its MD5 or SHA-1. SHA-256 and SHA-512 have no such weakness.