Integrity & Verification

Use checksums as evidence, not guesswork

Checksums are most useful when you need to know whether a file stayed exactly the same while being downloaded, copied, backed up, or handed to someone else. Matching hashes do not tell you that a file is safe or trustworthy; they tell you that two byte-for-byte versions are identical. That distinction is important when you are validating installers, backup sets, datasets, or deliverables.

For repeatable verification, record the hash algorithm together with the checksum and file name. A bare checksum copied into a note is easy to mix up later. Manifests are better when many files are involved because they keep names and expected values together and make missing or changed items easier to spot.

Practical tips

• Prefer SHA-256 for general verification unless a vendor or workflow specifically requires another algorithm.
• Compare checksums from an independent source when verifying downloads; a hash stored beside a compromised file proves very little.
• Generate a manifest before moving a large folder if you want a clean before-and-after integrity check.
• Do not use a matching checksum as proof that a file is malware-free; integrity and security are different questions.
• Keep checksum reports with the corresponding backup or release so future verification does not depend on memory.