Verifizieren ein downloaded file's checksum
Berechnen a file's hash locally, compare it with the publisher's checksum, and understand which algorithm to trust.
- 1
Integrity verification compares two hashes: the one the publisher published (e.g. sha256sums.txt on the release page) and one you compute from the file you actually received. Both happen locally here — the file is not uploaded.
- 2 Hash-Rechner →
Drop or paste the file content and select SHA-256 (the most widely published algorithm). The output is a 64-character hex digest.
- 3 Hash-Vergleich →
Paste your computed digest and the publisher's digest. The comparison is case-insensitive for hex and reports an exact match or an early divergence.
- 4
Interpretation: any single-bit difference in the file produces a completely different digest — a match means the bytes are identical. If they differ, re-download before assuming tampering: truncated transfers are the most common cause. For authenticity (was it really published by the vendor?), a checksum alone is not enough — verify a GPG or sigstore signature over the checksum file.
Häufige Fragen
- Which algorithm should I use?
- SHA-256 is the default choice and is what most projects publish. MD5 and SHA-1 still appear in legacy checksum files; they are adequate for accidental-corruption detection but must not be relied on against deliberate tampering.
- Isn't hashing the same as signing?
- No. A hash detects changes; a signature proves who produced the data. Strong release processes publish signatures over the checksum file, letting you verify both integrity and authenticity.