File Hash Verification: MD5, SHA256 Integrity Checks

What Is a File Hash

A hash (Hash) is an algorithm that converts data of any length into a fixed-length string. A file hash is a file's "fingerprint"—the same file always produces the same hash value, and changing a single byte produces a completely different hash.

Common uses:

• Verify file integrity (is the download complete)
• Prevent tampering (has the file been modified)
• Deduplication (are two files identical)
• Password storage (store hashes, not plaintext)

Common Hash Algorithms

MD5

• Output: 128 bits (32-character hexadecimal string)
• Fast
• Already broken; collisions exist (different files with the same hash)
• Not suitable for security purposes
• Still used for integrity checks (non-security scenarios)

SHA-1

• Output: 160 bits (40-character hexadecimal string)
• Moderate speed
• Already broken; collisions exist
• Not recommended for security scenarios
• Git originally used SHA-1, now migrating to SHA-256

SHA-256

• Output: 256 bits (64-character hexadecimal string)
• Slower
• Secure; no known collisions
• Recommended for security scenarios
• Used in blockchain and HTTPS certificates

SHA-512

• Output: 512 bits (128-character hexadecimal string)
• Slow
• Higher security than SHA-256
• Suitable for high-security scenarios

Selection Guide

• Integrity check (non-security): MD5 is sufficient (fast)
• Security scenarios: SHA-256 (balances security and speed)
• High-security scenarios: SHA-512
• Not recommended: SHA-1 (broken)

How Hash Verification Works

Generating a Hash

1. Read the entire file content
2. Compute the hash using a hash algorithm
3. Output a fixed-length string

Verification Process

1. Get the official hash value when downloading the file
2. Compute the local file's hash
3. Compare the two hash values
4. Match = file is intact; mismatch = file is corrupted or tampered

Why It Verifies Integrity

Properties of hash algorithms:

• The same input always produces the same output
• Different inputs almost never produce the same output (collision probability is extremely low)
• Changing one byte of input completely changes the output (avalanche effect)

So even a one-byte change in a file results in a completely different hash.

Use Cases

Download Verification

When downloading large files (system images, software installers), the official source provides a hash value. After downloading, compute the hash locally and compare to confirm the download is complete and undamaged.

Tamper Prevention

Generate a hash for important files (contracts, evidence) and archive it. Later, verify whether the file has been modified.

File Deduplication

If two files have the same hash, their contents are the same (collision probability is extremely low). Using hashes to check for duplicates is faster than byte-by-byte comparison.

Password Storage

Websites store the hash of user passwords, not plaintext. During login, the hash of the entered password is compared. Even if the database is leaked, attackers cannot obtain plaintext passwords.

Digital Signatures

Digital certificates use hash + encryption to verify file origin and integrity.

How to Verify File Hashes

Verify with DocsAll

File Hash tool:

1. Upload the file
2. The tool computes MD5, SHA-1, SHA-256
3. Display hash values
4. Compare with the official hash

Computation runs in the browser—files are not uploaded.

Windows Command Line

certutil -hashfile filename SHA256

Mac/Linux Command Line

shasum -a 256 filename
md5 filename

Comparing Hashes

• Copy the official hash value
• Paste into the comparison field
• The tool compares automatically
• Or compare character by character manually

FAQ

Hash Values Don't Match

• Incomplete download: Re-download
• File was tampered: Re-download from a trusted source
• Different hash algorithms: Confirm you are comparing with the same algorithm

Is MD5 Still Usable

• Integrity check (non-security): Yes
• Security scenarios (tamper prevention, passwords): Not recommended; use SHA-256
• Collision risk: It is possible to construct two different files with the same MD5

Can a Hash Be Reversed to Original Text

No. A hash is a one-way function. The original text cannot be recovered from a hash value. This is why storing password hashes is safe (even if leaked, plaintext cannot be obtained).

Hashing Large Files Is Slow

• Hashing requires reading the entire file
• Large files (several GB) take time to compute
• This is normal; be patient

Hash Value Case Sensitivity

Hash values are hexadecimal strings; case does not matter (a and A are equivalent). Ignore case when comparing.

Security Tips

Use Hash Values from Trusted Sources

Obtain hash values from official websites and trusted channels. Do not use hash values from unknown sources—they may have been replaced by attackers.

Use Strong Hash Algorithms

Use SHA-256 or higher for security scenarios. MD5 and SHA-1 are no longer secure.

Hash Is Not Encryption

Hashing is one-way and cannot be decrypted. Encryption is two-way and can be decrypted. Do not use hashing as encryption.

Salted Hashes

When storing passwords, use salted hashes (hash salt + password) to prevent rainbow table attacks.

Compute Hashes with DocsAll

File Hash tool:

1. Upload the file
2. Automatically compute MD5, SHA-1, SHA-256, SHA-512
3. Display all hash values
4. Copy the needed hash value
5. Compare with the official value

Computation runs in the browser—files are not uploaded to a server.

Summary

A file hash is a file fingerprint used for integrity verification and tamper prevention. MD5 is fast but broken; SHA-256 is secure and recommended. When verifying, obtain hash values from trusted sources and compare using the same algorithm. DocsAll File Hash tool runs in the browser and never transfers your files.