Check that a file has not changed using its hash
Published · Updated 2 min read
A hash is a very short summary of a file, calculated from all of its content. It answers one precise question: is the file I have just downloaded or received exactly the one its author published? If a single byte has changed, by accident during the download or through a deliberate change, the hash changes completely.
What the tool does
It calculates the SHA-1, SHA-256 or SHA-512 hash of a text or a file, or all three at once. The file can be up to 64 MB, and the calculation happens on your device, with nothing sent. SHA-256 is the most common choice today. SHA-1 is still useful for comparing with older publications, but it is no longer recommended for security.
One byte of difference
The strength of a hash lies in its sensitivity. On an audio recording, changing a single bit of the copy is enough to transform the hash completely: the two values no longer look alike at all. So you cannot guess whether two files are close by looking at their hashes: they are either identical or unrelated.
Compare with the reference
Serious publishers put the hash of their files next to the download link. Calculate the one for your copy, then compare it with the one on the page. If they are identical, the file is the same. Check the first and last characters to go fast, then the whole hash to be sure.
What a hash does not tell you
An identical hash proves that your file is identical to the one used to calculate it. It does not prove that this file is safe or that it contains nothing dangerous. And it is only worth something if the reference hash comes from a trusted source: a hash copied from the same doubtful site as the file guarantees nothing.
Going further
To understand the difference with Base64 and address encoding, see Base64, hash and encoded address, do not mix them up.
When to check a hash
After downloading software, a disk image or an important document, when the publisher puts the hash next to the link. It is also used to know whether two files are identical without opening them.
Frequently asked questions
- Which hash should you choose, SHA-1, SHA-256 or SHA-512?
- SHA-256 is the most common choice today. SHA-1 is used to compare with older publications but is no longer recommended for security. SHA-512 gives a longer hash.
- Does an identical hash guarantee that the file is safe?
- No. It proves that the file is the same as the one used to calculate it. It is only worth something if the reference hash comes from a trusted source.
- Is my file sent to calculate the hash?
- No, the calculation happens on your device, for a file up to 64 MB.
- Why do my two hashes look nothing alike?
- A single byte of difference is enough to change the hash completely. If they differ, the files are not identical.