File Integrity Checker

What a checksum actually proves

A matching hash proves the bytes you have are identical to the bytes that produced the published hash. That covers accidental corruption completely — a truncated download, a flipped bit, a failed transfer. What it does not cover is authenticity, because if an attacker can replace the file on a server, they can usually replace the hash listed beside it. A checksum published on the same page as the download protects against accidents, not adversaries.

Which algorithm to use

MD5 and SHA-1 are cryptographically broken: practical collisions exist for both, meaning two different files can be constructed to share a hash. They remain adequate for detecting accidental corruption and useless for detecting deliberate tampering. SHA-256 is the current default and is what any new system should publish. SHA-512 is faster on 64-bit hardware and equally sound. BLAKE3 is dramatically faster still and appearing in newer tooling.

Signatures are what prove origin

A GPG or PGP signature over the file, or over a file containing the hashes, is verified with the publisher's public key. That key is obtained independently — from a keyserver, a package manager, a separate domain — so an attacker who controls the download server cannot forge it. This is why Linux distributions sign their checksum files rather than merely publishing them, and why verifying only the hash misses the point of the exercise.

The comparison must be exact and case-insensitive

Hashes are hexadecimal, so case carries no meaning and tools differ in what they emit. Comparing by eye is where errors enter: people check the first and last few characters and skip the middle, which is precisely where a manipulated value would differ. Paste both into a comparison rather than reading them.

Line endings break text file hashes

A text file transferred between Windows and Unix systems may have its line endings converted, changing every line and therefore the hash, while the content is semantically identical. FTP clients in ASCII mode do this silently. If a text file's hash mismatches but the file opens correctly, this is usually why; binary transfer avoids it entirely.

Baselines detect change over time

Hashing a set of system files and storing the results gives a baseline to compare against later, which is how host intrusion detection identifies modified binaries. The baseline has to be stored somewhere the attacker cannot reach, since a baseline on the compromised host can simply be regenerated after the change.