ToolVault

You downloaded an installer and the site says "SHA-256: 9f86d0…". How do you confirm the file in your hands is the exact same one the publisher released—not a swapped copy from a mirror or MITM?

That's what hash verification solves.

Why hash verification matters

A hash function (SHA-256, MD5, SHA-1) turns any input into a fixed-length "fingerprint":

• Change even one byte of input and the hash changes completely (avalanche effect).
• You can't realistically reverse a hash back to the original.
• The same input always produces the same hash.

So comparing two hashes tells you whether content was altered.

| Scenario | Risk | What hashing does | |---|---|---| | Downloading OSS | Site compromised / mirror swapped | Compare against published hash | | Backup validation | Corruption in transit | Compare source vs copy | | API signature check | Request tampered | Server recomputes and compares |

⚠️ A hash only proves "content matches / doesn't match"—not "the source is trustworthy". If an attacker swaps both the file and the published hash, your check passes anyway. Real tamper protection needs digital signatures (GPG) or HTTPS + official domain.

Which algorithm to pick

| Algorithm | Output | Use | Safe? | |---|---|---|---| | MD5 | 128 bit | Quick checks, dedup | ❌ Broken (collisions); non-security only | | SHA-1 | 160 bit | Legacy | ❌ Broken | | SHA-256 | 256 bit | File checks, signatures, blockchain | ✅ Recommended | | SHA-512 | 512 bit | High-security | ✅ Recommended |

Rule: Use SHA-256 for anything new. MD5 only for "did it transfer intact", never for security.

Step-by-step verification (no software install)

Use this site's Hash Verifier—runs locally in your browser, files never leave your machine.

Verify a file

1. Open the Hash Verifier.
2. Pick the algorithm (default SHA-256).
3. Drag in or select the file.
4. The tool computes the file's hash instantly.
5. Paste the publisher's hash into the "compare" box and click compare:
   • ✅ Match → file is intact, unaltered.
   • ❌ Mismatch → corrupted or replaced, re-download.

Command line (developers)

# macOS / Linux – SHA-256
shasum -a 256 your-file.zip

# Windows (PowerShell)
Get-FileHash -Algorithm SHA256 your-file.zip

# MD5 (integrity only)
md5sum your-file.zip

Compare the output character-by-character with the published value.

Verify text / strings

To check two configs or two JSON blobs match, use the SHA-256 generator or MD5 generator, paste each, and compare outputs.

Batch / automated checks

For integrity scans across hundreds of files:

• Generate a baseline hash manifest (hash filename per line);
• Later recompute and diff against it.

In CI, sha256sum -c baseline.sha256 automates this.

About password hashing (common confusion)

"Is hash verification the same as bcrypt password hashing?" No. File checks use fast hashes (SHA-256) for speed; password storage uses slow, salted hashes (bcrypt, scrypt, Argon2) to resist brute force. Different jobs—don't mix them.

FAQ

Q: Hash mismatch—always tampering? Not necessarily. First check: right algorithm (SHA-256 vs MD5)? Extra spaces/newlines copied? File fully downloaded? Rule those out before suspecting tampering.

Q: Site only gives MD5, no SHA-256—usable? For "did it corrupt" yes; for security no (MD5 is collision-forgeable). Cross-check from multiple trusted sources.

Q: Same hash = official original? No. Hash proves "content matches", not "source trusted". Trust comes from HTTPS official domain, GPG signature, or code signing.

Q: Slow for multi-GB files? SHA-256 has CPU hardware acceleration; a few GB usually takes seconds. Disk read speed is usually the bottleneck, not hashing.

Summary

Verifying integrity = compute hash → compare with a trusted source's value. Prefer SHA-256; pair with digital signatures for sensitive cases. Use this site's Hash Verifier to do it locally—no upload, safer for sensitive installers.