Question 1

What is a file hash, and why do official downloads publish MD5/SHA256 checksums?

Accepted Answer

A hash is a one-way function that condenses arbitrary file content into a fixed-length fingerprint:

① Integrity Verification:
If even a single byte of the file is altered (corrupted in transit, or maliciously swapped), the resulting hash changes completely, confirming whether your downloaded file exactly matches the original published by the vendor.

② Common Use Cases:
OS installation images (ISOs), open-source software packages, and Docker image layers are typically published alongside MD5/SHA-1/SHA-256/SHA-512 checksums so users can verify the download after the fact, guarding against man-in-the-middle tampering or CDN mirror corruption.

Question 2

What is the difference between MD5, SHA-1, SHA-256, and SHA-512? Which one should I use?

Accepted Answer

These four algorithms differ in output length and security guarantees:

① Output Length:
MD5 produces 128 bits (32 hex characters), SHA-1 produces 160 bits (40 characters), SHA-256 produces 256 bits (64 characters), and SHA-512 produces 512 bits (128 characters).

② Security Recommendation:
MD5 and SHA-1 have known collision vulnerabilities and should never be used for digital signatures or password storage, though they remain useful for simply checking whether a download is corrupted or altered. When multiple checksums are provided, prefer SHA-256 or SHA-512 for verification.

Question 3

Which checksum manifest formats are supported? Can I just drop a downloaded .sha256 file in?

Accepted Answer

Yes, and the tool automatically figures out what each dropped file is for: ① Automatic Routing: When you drop a file into the main dropzone, if its extension or filename matches common checksum manifest conventions (e.g. .sha256, .md5, SHA256SUMS, CHECKSUMS), it is automatically parsed as a checksum manifest instead of being treated as a file to hash. ② Supported Formats: GNU coreutils output (` `, used by md5sum/sha256sum/shasum), BSD/OpenSSL format (`SHA256 (filename) = `), and a bare hash string with no filename (applied to every uploaded file).

Question 4

What does "Unsupported" in the comparison result mean?

Accepted Answer

It means the hash length in the manifest corresponds to an algorithm this tool does not compute:

① Common Cause:
This tool computes the five most common algorithms — MD5, SHA-1, SHA-256, SHA-512, and CRC32. If the manifest contains a SHA-384 hash (96 characters) or another variant, the tool honestly reports "Unsupported" rather than producing a misleading comparison.

② Workaround:
Compute it yourself with a built-in OS command (e.g. `shasum -a 384` on macOS/Linux, or `Get-FileHash -Algorithm SHA384` in Windows PowerShell) and compare visually against the manifest.

Question 5

What is CRC32? Does this tool support .sfv checksum files?

Accepted Answer

CRC32 is a lightweight cyclic redundancy check widely used by ZIP, PNG, and SFV formats for error detection:

① How It Differs From Cryptographic Hashes:
CRC32 is not a cryptographically secure hash — it is designed to quickly catch random transmission errors (disk bad sectors, transfer noise) rather than deliberate tampering, so it should not be relied on for security verification, though it remains useful for checking whether a download got corrupted.

② SFV Support:
This tool supports the standard `.sfv` format (`filename  crc32hex`, filename first followed by the 8-character hex CRC32, with lines starting with `;` treated as comments). Dropping a `.sfv` or `.cksum` file into the main dropzone automatically routes it to the checksum manifest parser.

Question 6

How do I export the computed hashes into a file to share with someone else? Can the downloaded manifest be verified with built-in OS commands?

Accepted Answer

That's exactly what the "Download checksum manifest" control above the file list is for:

① How to Use It:
Pick an algorithm from the dropdown (MD5 / SHA-1 / SHA-256 / SHA-512 / CRC32) and click "Download" — every file that has finished hashing gets exported into a single GNU coreutils-compatible text file (e.g. `SHA256SUMS.txt`), with a header noting the UTC generation time and a `tools.cjkuo.net` attribution comment.

② Universal Compatibility:
The file can be verified directly with built-in OS commands, such as `sha256sum -c SHA256SUMS.txt` or `md5sum -c MD5SUMS.txt` on macOS/Linux, or `Get-FileHash` for manual comparison on Windows. You can also drop the exported file straight back into this tool — it will be auto-detected as a checksum manifest and parsed for verification.

Question 7

Why does computing MD5 on a large file (e.g. a multi-GB disk image) feel slower than SHA-256?

Accepted Answer

This comes down to the underlying compute engine:

① Native Acceleration vs. Pure Software:
SHA-1/256/512 are computed via the browser's native Web Crypto API (SubtleCrypto), which benefits from low-level and sometimes hardware-accelerated implementations. MD5 is not natively supported by browsers, so this tool implements RFC 1321 in pure JavaScript, which is inherently slower.

② No Freezing, Guaranteed:
Even so, this tool periodically yields control back to the main thread while computing MD5, so the page stays scrollable and you can keep dragging in new files even while a large file is being hashed.

Question 8

Is my file content uploaded to a server when I compute its hash on this site?

Accepted Answer

Never! This tool is a 100% client-side application:

① Local Memory Processing:
All file reading and hash computation happen entirely within your browser via the native File API and Web Crypto API, on your local device memory.

② Zero Cloud Upload:
File content, filenames, and computed results are never transmitted to any server or third party, making this safe for verifying confidential internal documents or proprietary software installers.

File Hash Calculator & Checksum Verifier

Frequently Asked Questions (FAQ)8 Q&As