Glossary Data & Encoding

Checksum

A checksum is a small value calculated from a block of data and used to detect accidental errors when the data is stored or sent.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

The receiver recomputes the checksum and compares it with the one sent; a mismatch means the data changed. Simple ones such as CRC-32 catch random corruption cheaply and are built into Ethernet, ZIP and PNG. Check digits are tiny checksums too: the Luhn digit on payment card numbers and the last digit of an ISBN or Barcode catch most typing errors.

Why it matters

Download pages often list a SHA-256 value so you can confirm the file arrived intact. A matching checksum only proves the file equals the one the checksum came from: if an attacker can replace both the file and the value on the same page, the check proves nothing. Non-cryptographic checksums such as CRC-32 can also be deliberately forged, so they detect accidents, not tampering.

Example

A single changed bit gives a completely different value. The CRC-32 of hello is 3610a686, while Hello gives f7d18982. On Linux:

$ printf 'hello' | sha256sum
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -

Common confusion

Every cryptographic Hash can be used as a checksum, but not every checksum is a secure hash. See How Hashing Works.

AdSense Placeholder
Slot: footer_leaderboard