A checksum (or hash) is a fixed-length string generated by running a file through a hashing algorithm. The same input always produces the same output, and changing even a single byte of the file -- a corrupted download, a tampered installer -- produces a completely different hash. That's the entire mechanism. It isn't encryption, and there's no way to reverse a hash back into the original file.
Why software publishers post them
When you download an OS image, a package, or an installer, the publisher often lists a SHA-256 hash next to the download link. After downloading, you run the same algorithm against your copy and compare the result to what's published. If they match, your download is byte-for-byte identical to what the publisher uploaded. If they don't match, something changed -- most often a corrupted or incomplete download, occasionally a file swapped somewhere along the way.
MD5 vs SHA-1 vs SHA-256
These are just different hashing algorithms, and the letters and numbers refer to the length and design of the output.
- MD5 produces a 128-bit hash and is still common for quick integrity checks, but it's cryptographically broken -- it's possible to construct two different files that produce the same MD5 hash, so it shouldn't be trusted anywhere security actually matters.
- SHA-1 produces a 160-bit hash and is also considered broken for security purposes, though you'll still see it listed on older software.
- SHA-256 produces a 256-bit hash and is the current standard for anything where tamper resistance matters, from software distribution to blockchain.
If a site only publishes an MD5 checksum, it's fine for catching a corrupted download. If you're verifying something security-sensitive and SHA-256 is available, use that instead.
What a checksum doesn't tell you
A matching hash doesn't mean a file is safe -- it only means the file matches what the publisher put up for download. If the publisher's own server were compromised and a malicious file's hash were updated alongside it, checksum verification wouldn't catch that. What it protects against is corruption in transit and a file being swapped somewhere between the original source and you -- a mirror, a CDN, a compromised download link -- not the source itself being compromised.
When it's actually worth checking
Most everyday downloads don't need this step. It's worth the extra 30 seconds for OS images and installers you're about to run with elevated privileges, files pulled from a mirror rather than the original source, and anything where the publisher goes out of their way to list a hash next to the download -- that's usually a signal they consider integrity important, which is common for security tools and cryptographic software.
Generating and checking hashes
Checksum Generator hashes a file with MD5, SHA-1, or SHA-256 so you can compare it against a publisher's listed value, and Hash Generator does the same for plain text if you need to hash a string rather than a file.