Work out checksum verification instantly with clear inputs, formula shown and shareable results.
A checksum verifies that bytes arrived intact, but only a collision-resistant hash verifies they were not deliberately substituted. MD5 and SHA-1 both have practical collision attacks, so an attacker can craft two files with the same digest — which is why signed SHA-256 or better is required for software distribution, while MD5 remains adequate only for detecting disk or transfer corruption.
Hashing cost and strength
time = file bytes / (throughput x algorithm factor); collision resistance = digest bits / 2 for unbroken hashes
Only if the checksum itself is authenticated, typically by a signature or by being served over a channel the attacker cannot modify. A checksum on the same compromised page proves nothing.
It is designed for parallelism and SIMD, hashing a tree of chunks concurrently rather than a single serial chain, so it scales with cores where SHA-2 does not.