You download a program and the site shows a long string of letters and digits next to the link: that is a fingerprint (hash) which lets you check that the file was neither corrupted nor altered. The same mechanisms are used, in another context, to store passwords. The two uses call for different algorithms, and mixing them up is a common security mistake.
What a fingerprint is
A hash function turns any data (a word, a 4 GB file) into a fixed-length string. It is deterministic (the same input always gives the same fingerprint) and sensitive: changing a single bit changes the result completely. For example, the SHA-256 of the text “abc” starts with ba7816bf…, whereas that of “abd” starts with a52d159f…, with no resemblance at all. The operation cannot be reversed: you cannot recover the text from the fingerprint.
| Algorithm | Size | Hexadecimal characters | Status |
|---|---|---|---|
| MD5 | 128 bits | 32 | Broken for security (collisions can be crafted); enough to detect accidental corruption. |
| SHA-1 | 160 bits | 40 | Obsolete for security. |
| SHA-256 | 256 bits | 64 | Current reference for integrity. |
| SHA-512 | 512 bits | 128 | Longer fingerprint. |
Verifying a downloaded file, step by step
- Find the published fingerprint on the official site (often “SHA256” or “checksum”), ideally on an HTTPS page different from the download link.
- Open SHA-256 Hash Generator (or MD5 Hash Generator if only MD5 is published) and drop the file. It is read in 4 MB blocks with a progress bar: even a large file (up to 4 GB) does not exhaust memory. You can drop several.
- Paste the expected fingerprint into “Compare”: hex (upper or lower case, with or without “:”), base64 or an sha256sum output line are accepted.
- If the tool shows a match, the file is identical to the one the publisher released. Otherwise, do not open it: download it again.
An important point: a fingerprint verifies that you received the same file as the one described, not that the file is harmless. If an attacker controls both the file and the fingerprint displayed on the same page, the check proves nothing.
Hashing text: the details that change everything
Text is hashed as UTF-8, exactly as typed. A trailing line break changes the fingerprint: the SHA-256 of “abc” and that of “abc” followed by a newline are completely different (edeaaff3… against ba7816bf…). This is the most frequent cause of “my hash doesn't match”: check for invisible spaces and line breaks. Tick HMAC to produce an authentication code with a secret key: only someone who knows the key can reproduce the same fingerprint.
Passwords: why not SHA-256, and bcrypt instead
- The salt is random and embedded in the result: the same password gives a different hash each time, and verification still works.
- bcrypt reads only the first 72 bytes of the password (in UTF-8, an accented letter counts as 2, an emoji as 4): the tool warns you when the limit is exceeded.
- Computation runs without freezing the screen, with a real progress bar; the password is neither sent nor saved.
To choose a strong password, read Strong passwords: entropy, passphrases and data breaches.
Common mistakes
- Using MD5 or SHA-1 for signatures or passwords.
- Storing passwords with a plain SHA-256, even salted.
- Comparing fingerprints by eye: a single letter differs and you do not see it. Use the tool's comparison.
- Ignoring case or line-break differences when hashing text.
- Believing an identical fingerprint guarantees the file is harmless.
Honest limits
- A hash encrypts nothing: it is not reversible but short passwords can be found by guessing.
- MD5 and SHA-1 fingerprints should no longer be used for security.
- bcrypt is a solid choice but does not replace a complete policy (attempt limiting, two-factor authentication).
Frequently asked questions
Is my file uploaded to compute its fingerprint?
No. The calculation is done in your browser; the file is read in 4 MB blocks on your device.
Why do two almost identical texts have unrelated fingerprints?
By design: changing a single bit changes the result completely. This is called the avalanche effect.
Is MD5 still usable?
To detect accidental corruption, yes. For any security purpose (signature, password), no: use SHA-256 or, for passwords, bcrypt.
Which bcrypt cost should I choose?
10 to 12 for a website. Choose the highest value your servers support without slowing users' login.
Can a text be recovered from its fingerprint?
Not directly. But a short or common password can be found by guessing, hence the value of a slow algorithm such as bcrypt.