Last updated
What Is a Checksum?
A checksum is a small fixed-size value derived from a block of data by running it through a hash function. Its purpose is to detect errors or tampering: if even a single bit of the original data changes, the checksum changes completely. This property — called the avalanche effect — is what makes checksums useful for verifying file integrity after downloads, network transfers, or storage.
When you download a Linux ISO or a software package, the publisher typically provides a SHA-256 checksum alongside the file. After downloading, you compute the checksum of your local file and compare it to the published value. If they match, the file arrived intact and unmodified.
Hash Algorithms Compared
| Algorithm | Output size | Speed | Security | Use today |
|---|---|---|---|---|
| CRC32 | 32 bits (8 hex) | Very fast | None (not cryptographic) | Error detection in ZIP, PNG, Ethernet |
| MD5 | 128 bits (32 hex) | Fast | Broken (collision attacks) | Non-security checksums only |
| SHA-1 | 160 bits (40 hex) | Fast | Deprecated (SHAttered attack) | Legacy systems, Git object IDs |
| SHA-256 | 256 bits (64 hex) | Good | Strong | File integrity, TLS, Bitcoin |
| SHA-512 | 512 bits (128 hex) | Slower | Very strong | High-security applications |
Verifying a File Checksum on the Command Line
# Linux / macOS — SHA-256
sha256sum ubuntu-24.04.iso
# or
shasum -a 256 ubuntu-24.04.iso
# Windows PowerShell
Get-FileHash ubuntu-24.04.iso -Algorithm SHA256
# Compare against published hash
echo "expected_hash ubuntu-24.04.iso" | sha256sum --checkCRC32 vs Cryptographic Hashes
CRC32 is not a cryptographic hash — it's a cyclic redundancy check designed purely for accidental error detection, not security. It's extremely fast and used in ZIP files, PNG images, and Ethernet frames to catch transmission errors. However, it's trivial to craft two different inputs with the same CRC32, so never use it to verify security-sensitive data.
For security purposes — verifying software downloads, storing passwords (with a proper KDF like bcrypt), or signing data — always use SHA-256 or stronger. The NIST hash function standards provide authoritative guidance on which algorithms are approved for federal use.
MD5 and SHA-1 are still widely used for non-security checksums (e.g., detecting duplicate files, cache keys) because they're fast and the collision risk doesn't matter in those contexts. Just never use them for password hashing or digital signatures.