What a checksum verifies
A checksum is a fixed-length fingerprint of a file's exact bytes. Download the same file twice, or copy it across a flaky connection, and even one flipped bit produces a completely different checksum — which makes it a fast, reliable way to confirm a file arrived intact and matches the copy the publisher intended you to have.
Which algorithm to trust
- CRC-32 — not cryptographic, but fast and effective at catching accidental corruption. It's what ZIP and PNG use internally for exactly this reason. Trivial for an attacker to forge, so it only tells you a file wasn't accidentally damaged, never that it wasn't tampered with.
- MD5 / SHA-1 — both cryptographically broken for collision resistance. Still common on older download pages for accidental-corruption checks, but don't treat a match as proof a file is safe from deliberate tampering.
- SHA-256 / SHA-512 — the ones worth trusting when integrity actually matters, including against an adversary. If a publisher offers a SHA-256 checksum alongside older ones, verify against that.
See MD5 vs SHA-256 vs SHA-512 for the full breakdown of why the older algorithms are still around despite being broken. Only need the cryptographic hashes, not CRC-32? See File Hash Calculator. For hashing pasted text instead of a file, see Hash Generator.
How this is computed
Your file is read locally with the File API and hashed entirely in your browser — SHA-1, SHA-256, and SHA-512 via the native Web Crypto API, MD5 and CRC-32 via small pure-JavaScript implementations (Web Crypto deliberately omits both, since neither is considered cryptographically secure). The file itself is never uploaded or transmitted anywhere.