Lessons · Cybersecurity · comparing a file hash

Comparing a fingerprint

A file's hash is its fingerprint, so comparing the hash you compute against the one the publisher states tells you whether you have the file they published or a different one.

Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.

What it is for

The installer downloaded fine and the page looked right. The published hash did not match what the file produced, which meant the file had been changed between the publisher and the disk. Ten seconds of comparison against a day of clean-up.

How to think about it

Get the published hash from the publisher's own site, not from the page that offered you the download. Compute the hash of your copy. Compare the whole string, not the first few characters. If they differ at all, stop, and keep the file for whoever investigates.

Worked example

Published: 7f83b1657ff1fc53b92dc181

Written down first, from the source you trust.

Computed from the downloaded file: 7f83b1657ff1fc53b92dc181

Same string, character for character.

Same input always gives the same fingerprint, so equal means the same file

That is the whole guarantee, and it is enough.

Different anywhere means a different file, and you do not install it

There is no such thing as almost matching.

Your turn

Two hashes differ in one character. Write what that makes the two files.

the files are

The trap

Taking the published hash from the same page as the download. Whoever could change the file could change the number printed next to it.

Practise comparing a file hash on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.