Hash Compare

The right way to verify a hash by comparison

Why a dedicated comparison tool is needed

Verifying file integrity goes like this: take a hash from the publisher, compute the hash of your local file, and compare the two. It sounds like "just eyeball whether they match", but there are several easy mistakes in practice:

• Case mismatch. The same hash exists in uppercase and lowercase hex, and A3F1... and a3f1... are the same value. By eye it is easy to misjudge a difference as real. The correct move is to normalize to lowercase before comparing.
• Hidden whitespace. Hash values are often copied from a web page and pick up trailing spaces, newlines or invisible zero-width characters. They do not change how the value "looks", but they break a string comparison.
• Copying only part of it. SHA-256 is 64 characters, long enough that dropping a middle section is hard to notice.
• Mixing algorithms. MD5 is 32 characters, SHA-1 is 40, SHA-256 is 64, SHA-512 is 128. If the lengths differ, they are simply not the same algorithm — no need to compare further.

The correct flow

1. Compare length first. Different length means mismatch, and the length also hints at the algorithm (32 means MD5, 40 means SHA-1, 64 means SHA-256, 128 means SHA-512).
2. Normalize case and trim leading/trailing whitespace.
3. Compare character by character, and when a difference appears, locate it. A difference in just one segment suggests a truncated copy; an entirely different value usually means the file itself is wrong or the algorithm differs.
4. Confirm the algorithm matches. If the publisher gave SHA-256, you cannot compute MD5 and compare against it.

What it defends, and what it does not

A hash comparison confirms that the file in your hands is the same one the publisher hashed, or at least that the contents match. It catches transmission corruption during download, a CDN serving a stale version, and grabbing the wrong file by mistake.

What it cannot defend against is someone who replaces both the file and the hash on the page. If an attacker can alter your download source, they can alter that hash too. To defend that layer you must place the hash somewhere they cannot reach — an HTTPS site (assuming the certificate is intact), an officially signed distribution channel, or a digital signature that makes the hash itself verifiable.

One more point: MD5 and SHA-1 hashes cannot prove "the file was not altered", because practical collision attacks exist for both. They are only fit for detecting accidental corruption.

How to use the tool

Paste the two hash values into the inputs. The tool compares after ignoring case and surrounding whitespace, and tells you clearly whether they match and whether the lengths are equal. It also accepts the hash filename checksum-file format (such as the output of sha256sum) and extracts the hash automatically. Everything is computed locally; nothing is uploaded.