Verify a downloaded file CHECKSUM

What a matching hash proves, and what it does not

A hash is a fingerprint of the bytes. Change one bit anywhere in the file and the hash changes completely, so if the value here matches the one the publisher printed, the file you have is byte for byte the file they built.

That is the whole of what it proves. In particular it does not prove the file is safe: a publisher can sign a program that does something you would not want, and malware with a published hash still matches its published hash. A match answers "did this arrive intact and unmodified", not "should I run this".

It also only means anything if the hash came from somewhere the attacker does not control. A checksum printed on the same page as the download link, on a site that has been compromised, was changed at the same time as the file. Take the value from the project's signed release notes, its repository, a distribution's package index or a second source, and be suspicious of a hash that lives right next to the button.

Which algorithm, and why the choice matters less than it looks

• SHA-256 is the right default and what almost every publisher now prints.
• SHA-384 and SHA-512 are longer and no worse. If a publisher gives one of these, use it and compare the whole string.
• SHA-1 is here because a great deal of existing software still prints it, and it is broken for the purpose of resisting a deliberate collision: a practical attack has existed since 2017. It remains perfectly good at catching a corrupted download, which is a different question, and this tool will compute it while being clear about which of the two you are answering. If you are checking against tampering and SHA-1 is all that is offered, that is worth noticing about the publisher.

Comparing it properly

Do not read the two strings and decide they look the same. Sixty-four hexadecimal characters all look the same, and the failure mode people actually hit is glancing at the first four and the last four. Paste the published value into the box so the comparison is done character by character, and let a mismatch be loud.

A mismatch usually means an interrupted or resumed download rather than an attack. Download it again before assuming the worst. If it mismatches twice, from two networks, stop.

For a file you have been sent rather than downloaded, ATTEST records the hash with a timestamp so you can show later that the copy you analysed is the copy you were given, and SIEVE hashes a whole folder at once against a list you already hold.