What Is a Checksum?

A checksum is the outcome of running an algorithm, called a cryptographic hash function, on a piece of data, usually a single file. Comparing the checksum that you generate from your version of the file, with the one provided by the source of the file, helps ensure that your copy of the file is genuine and error free.

A checksum is also sometimes called a hash sum and less often a hash value, hash code, or simply a hash.

A Simple Checksum Example

The idea of a checksum or a cryptographic hash function might seem complicated and not possibly worth the effort, but we'd like to convince you otherwise! Checksums really aren't that hard to understand or create.

Let's start with a simple example, hopefully showcasing the power of checksums to prove something has changed. The MD5 checksum for the following phrase is a long string of characters that represent that sentence.

This is a test.
120EA8A25E5D487BF68B5F7096440019

For our purposes here, they essentially equal each other. However, making even a slight change, like removing just the period, will produce a completely different checksum.

This is a test
CE114E4501D2F4E2DCEA3E17B546F339

As you can see, even a minuscule change in the file will produce a vastly different checksum, making it very clear that one does not equal the other.

Checksum Use Case

Let's say you download a big software update, like a service pack. This is probably a huge file, taking several minutes or more to download.

Once downloaded, how do you know the file was received properly? What if a few bits were dropped during the transfer and the file you have on your computer right now isn't exactly what was intended? Applying an update to a program that isn't exactly the way the developer created it is likely to cause you big problems.

This is where comparing checksums can put your mind at ease. Assuming the website you downloaded the file from provides the checksum data alongside the file to be downloaded, you can then use a checksum calculator (more on those below) to produce a checksum from your downloaded file.

For example, say the website provides this checksum for the file you downloaded

MD5:5a828ca5302b19ae8c7a66149f3e1e98 

You then use your own checksum calculator to produce a checksum using the same cryptographic hash function, MD5 in this example, on the file on your computer.

Do the checksums match? Great! You can be very confident that the two files are identical.

Do the checksums not match? This can mean a number of things:

• Someone replaced the download with something malicious without you knowing.
• The file was changed on purpose by you. As you read above, this could be an imperceptible change, like adding or removing a single letter or other character.
• You're comparing a totally different, but harmless file, like a newer version if it's a software program, or an updated document.
• The network connection was interrupted, and the file didn't finish downloading, or there was an issue with storing the file once it reached your hard drive. Try downloading the file again and then create a new checksum on the new file, and then compare again.

Checksums are also useful for verifying that a file you downloaded from somewhere other than the original source is, in fact, a valid file and hasn't been altered, maliciously or otherwise, from the original. Just compare the hash you create with the one available from the file's source.

Checksum Calculators

Checksum calculators are the tools used to compute checksums. There are plenty of them out there, each supporting a different set of cryptographic hash functions.

One great free option is ​Microsoft File Checksum Integrity Verifier, called FCIV for short. It supports only the MD5 and SHA-1 cryptographic hash functions, but these are by far the most popular right now. Microsoft File Checksum Integrity Verifier is a command-line program, but is very easy to use.

You can also use the certutil program built-in to Windows. This is also a command-line tool, but it's equally easy to use it to validate the MD5 checksum of files. That article also describes how to do the same on Linux with md5sum.

Another excellent free checksum calculator for Windows is IgorWare Hasher, and it's completely portable, so you don't have to install anything (but you will need a RAR file opener to unpack the program). If you're not comfortable with command-line tools, this tool is probably a better choice. It supports MD5 and SHA-1, as well as CRC32. You can use it to find the checksum of text and files.

JDigest is an open source checksum calculator that works in Windows as well as on macOS and Linux.

If you'd rather use an online calculator, we like this MD5 file checksum tool because it lets you upload files.