How to use algorithms
| Algorithm | Main uses | Points to note |
|---|---|---|
| SHA-256 | Checking the integrity of distributed files | Current common first choice |
| SHA-384 / SHA-512 | Consistency checks that require long output | Select the same method as the comparison destination |
| SHA-1 | Check with old distribution | Poor collision resistance and unsuitable for new applications |
| MD5 | Check against old checksum | Not used for security purposes |
How to Verify a File
- Check the algorithm name and expected value provided by the distributor.
- Select the downloaded files and generate each hash value within your browser.
- Compares with the generated value without distinguishing between uppercase and lowercase letters in hexadecimal notation, excluding spaces and line breaks before and after the expected value.
- If they do not match, do not run the file, re-download it, and check the distribution source.
What a Hash Cannot Tell You
If an attacker replaces the file and the posted hash value at the same time, the values will match. Also check the route through which you obtained the expected value, such as HTTPS, signature, and official distribution page.
Plain SHA-256 is not suitable for password storage. Use a purpose-built password-hashing algorithm such as Argon2 or bcrypt, with a salt and an appropriate computational cost.
Even if the file name and update date and time are the same, the contents are not necessarily the same. A hash value is used to confirm content matching.
Try It in Your Browser
Your input is processed entirely in your browser. Keep the original data, review the output, and only then save or share it.
Open hash value generation/verification tool