Question 1

How do I verify a downloaded file's checksum?

Accepted Answer

Open the VERIFY tab, paste the checksum published by the software vendor (e.g. a SHA-256 sum from a download page), then select the downloaded file. ShieldScope automatically detects which algorithm the checksum belongs to based on its length, computes the file's hash locally in your browser, and reports MATCH or MISMATCH. A mismatch means the file differs from what the vendor published — it may be corrupted or tampered with.

Question 2

Is it safe to hash a password with this tool?

Accepted Answer

Nothing you type is transmitted — all hashing runs locally in your browser via WebAssembly. However, hashing a password with SHA-256 or SHA-512 is not how passwords should be stored. General-purpose hash functions are designed to be fast, which makes them weak against offline cracking. Password storage needs a slow, salted key derivation function such as Argon2 or bcrypt instead. For password strength analysis, see ShieldScope's /password tool.

Question 3

What is the difference between MD5 and SHA-256?

Accepted Answer

Both are hash functions that turn data into a fixed-length digest, but MD5 is cryptographically broken — collisions (two different inputs producing the same hash) can be generated deliberately, so MD5 must not be used anywhere security depends on collision resistance, such as digital signatures or certificates. SHA-256 has no known practical collision attack and is the current standard for integrity verification and cryptographic use. MD5 is still commonly seen for simple, non-adversarial checksums like verifying an accidental download error, but SHA-256 or better should be used whenever the data source might be untrusted.

Question 4

Why do software vendors publish SHA-256 checksums?

Accepted Answer

A published checksum lets you confirm a downloaded file is byte-for-byte identical to what the vendor built — protecting against corrupted downloads, mirror tampering, or a compromised distribution channel substituting a malicious file. Since a single changed byte produces a completely different hash, comparing the computed hash of your download against the vendor's published value is a reliable integrity check, though it depends on you retrieving the published checksum from a trustworthy source separate from the download itself.

Hash Generator & File Checksum Verifier