Why Official Downloads Publish a Checksum Next to the File

A checksum is a fingerprint for exact bytes

A cryptographic hash function like SHA-256 takes a file's contents and produces a fixed-length hex string that changes completely if even a single bit of the file is different. Publishing that hash alongside a download gives anyone a way to independently confirm the file they received is byte-for-byte identical to what the publisher actually released.

What it actually catches

Two distinct problems, both real: corruption, where a download gets interrupted or a disk error silently damages a file in transit, producing a file that looks complete but isn't; and tampering, where a file is swapped for a malicious one, whether via a compromised mirror server, a man-in-the-middle attack, or a fake download site impersonating the real one. In either case, recomputing the hash yourself and comparing it to the published value will reveal the mismatch immediately, since even a single altered byte produces a completely different hash.

Why SHA-256 and not MD5 for this

MD5 is still fast enough to compute today, but it's no longer collision-resistant in the way this use case needs — researchers have demonstrated that two different files can be deliberately crafted to produce the same MD5 hash, which defeats the purpose of using it to detect deliberate tampering. That's why virtually every official download page that publishes checksums today uses SHA-256 (or occasionally SHA-1, though that's also weakening), not MD5.

Try it yourself

Our File Checksum Verifier computes SHA-256, SHA-1 or SHA-512 for any file directly in your browser, and can instantly compare it against a hash you paste in.