What is a checksum?

How it works

A checksum function reads every byte of a file and runs it through a fixed calculation, producing a short result such as a 32 or 64 character hex string. The key properties are:

• Identical input always gives identical output.
• Even a one-byte change gives a completely different output.
• The output is short and fixed in length, whatever the file size.

Common checksum algorithms include MD5, SHA-1, and SHA-256.

What it is used for

Checksums answer two questions:

• Are these two files the same? Compare their checksums. Same checksum means same contents, regardless of file name or location.
• Did this file arrive intact? When you download software, the site often lists a checksum. Compute the checksum of your copy and compare. A match means nothing was corrupted or altered in transit.

Why not just compare sizes

File size is a weak signal. Two different files can happen to be the same size, and two copies of the same file can differ by a few metadata bytes while the meaningful content is identical. A checksum reads the whole file, so it does not get fooled the way a size comparison does. It is the honest way to tell whether two files match.

Choosing an algorithm

For spotting accidental duplicates or verifying a download from a source you trust, MD5 is fast and fine. When the check has to resist someone deliberately faking a match, use SHA-256, which is designed to make that practically impossible. Many tools compute all three so you can pick per situation.