Choose a file to hash it.
Nobody reads sixty-four hex characters. People check the first four and the last four — and that is precisely the check a substituted file is built to pass.
So the machine does the comparing here. Paste the line the publisher printed and one word comes back.
And there is a limit to what a match means, which is printed too. It says the file is byte for byte the one whose digest that was. It says nothing about whether the publisher is trustworthy, and nothing about whether the page you copied the digest from was really theirs — somebody able to replace a download can usually replace the line printed beside it.
A signature proves who published something. A checksum only proves what arrived.
And there is no MD5 here, deliberately. Two different files can be constructed with the same MD5, so a match no longer proves they are the same file. Offering it beside SHA-256 without a word would let somebody verify a download with a check a capable attacker can defeat — and believe they had verified it.
No. It is read from your disk into this browser tab and hashed there. There is no upload and no server, which matters here for an unusual reason: a checksum page that uploaded your file would have to be trusted not to substitute the answer, and then the check would prove nothing at all.
Because nobody reads sixty-four hex characters. People check the first four and the last four, and a substituted file is built to pass exactly that glance. Paste the line the publisher printed and the comparison is done character by character, which is the only version of this check that is worth doing.
Before assuming the worst: the commonest causes are a download that stopped early, a digest copied from a different version of the same thing, or a file that something opened and re-saved on the way. Check the file size against the one on the download page, then download it again. If it still disagrees, do not run it.
That the file is byte for byte the one whose digest you pasted. That is all. It says nothing about whether the publisher is trustworthy, and nothing about whether the page you copied the digest from was really theirs — somebody able to replace a download can usually replace the line printed beside it. A signature proves who published something; a checksum only proves what arrived.
Because it is broken for this job. Two different files can be constructed with the same MD5, so a matching digest no longer proves two files are the same file — and offering it beside SHA-256 without a word would let somebody verify a download with a check a capable attacker can defeat, and believe they had verified it. SHA-1 is out for the same reason. Where a publisher offers only an MD5, the honest answer is that the publisher should print something better.
SHA-256 is the right default and is what almost everything publishes now. SHA-512 is not meaningfully more secure for this purpose — it is faster on 64-bit machines and produces a longer string. If a publisher offers SHA-256 and MD5, use the SHA-256 and ignore the other one.
No. A hash is computed from the contents alone, so renaming a file, changing its timestamp or moving it between drives never changes its digest. That is what makes the check useful: it survives everything except a change to the bytes themselves.
Because the browser’s own crypto is asynchronous, and this site’s calculation engine is built entirely from pure synchronous functions — one await would have changed the shape of the whole layer. So SHA-256 and SHA-512 are written out by hand in it. The dividend is that they behave identically in every browser and work with no connection at all.
The browser’s own crypto is asynchronous, and this site’s calculation engine is built entirely from pure synchronous functions — one await would have changed the shape of the whole layer. So SHA-256 and SHA-512 are written out by hand in it. The dividend: identical behaviour in every browser, and it works with no connection at all.
The file is read in your browser and nothing about it is transmitted or stored. A matching checksum proves the file is the one whose digest you pasted — it does not prove the publisher is trustworthy, or that the digest itself came from them. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
