Understanding File Hashes: When to Care and When Not To

A file hash is a short fingerprint computed from the file's exact bytes. Change one byte, get a completely different hash. That property makes hashes useful for verifying downloads, detecting duplicates, and — with more math — signing releases.

For a plain download verification, any modern hash (SHA-256, BLAKE3) is fine. The publisher posts a hash next to the download link; you compute the same hash locally and compare. If they match, the file has not been tampered with in transit or by a malicious mirror.

MD5 and SHA-1 still show up on older projects. For a hobby download from a small publisher, MD5 is fine as a corruption check but should not be trusted for tamper detection — SHA-256 or better is the norm now.

Where hashes cannot help: they cannot tell you whether the file was safe to begin with. A signed hash from a compromised publisher is still a compromised file. Hash verification is one layer, not the whole answer.

Further reading: Wikipedia — PDF format overview.