What Is a Checksum?

Linux distributions such as Ubuntu and Debian publish a file called SHA256SUMS next to their installer images. Each line holds a 64-character string and a file name. After your download finishes, you run one command on the file you received. If it prints the same string, all of its billions of bytes arrived intact. If a single bit flipped on the way, the string comes out completely different.

That string is a checksum: a small summary that changes when the data changes.

How a checksum works, step by step

1. The sender runs a checksum algorithm over the data, byte by byte, and gets a short result.
2. The result travels or is stored with the data: in the header of a network packet, inside a ZIP file next to each compressed file, or on a download page.
3. The receiver runs the same algorithm over the data it actually got.
4. The two results are compared. If they are equal, the data is almost certainly unchanged. If they differ, the data was damaged, and the receiver rejects it, asks for it again, or shows a checksum error.

A checksum only detects damage; it cannot say which byte changed or repair it. Repair needs an error-correcting code, such as the Reed-Solomon codes on CDs and QR codes.

The simplest checksum adds up all the bytes and keeps the last 8 bits of the total. Run this to see where that idea works and where it fails:

import zlib

def byte_sum(data):
    # Add every byte, keep only the last 8 bits (0 to 255)
    return sum(data) % 256

original = b"PAY 100 TO ANA"
flipped  = b"PAY 300 TO ANA"   # one character changed
swapped  = b"PAY 010 TO ANA"   # two characters swapped

for label, data in [("original", original), ("flipped", flipped), ("swapped", swapped)]:
    print(f"{label:9} sum={byte_sum(data):3}  crc32={zlib.crc32(data):08x}")

original  sum= 78  crc32=a1628836
flipped   sum= 80  crc32=a597580b
swapped   sum= 78  crc32=59dbf74b

Changing a character changes the sum. Swapping two characters does not, because addition does not care about order, so the byte sum approves a payment of 10 instead of 100. CRC-32 (cyclic redundancy check) treats the data as one long binary number and divides it by a fixed 33-bit polynomial; the 32-bit remainder depends on where every bit sits, so the swap is caught. The demo above lets you try this on your own text. CRC-32 catches every burst of errors up to 32 bits long.

Common checksum algorithms

The first five catch accidents, not attackers. Someone who edits a file can adjust a few bytes so its CRC-32 matches again. MD5 and SHA-256 are cryptographic hash functions, designed so that finding two inputs with the same output is impractical. MD5 has since been broken (collisions were published in 2004), and so has SHA-1 (2017), so security-sensitive downloads use SHA-256 or stronger. MD5 still catches accidental corruption perfectly well.

How to verify a checksum

On your own computer, each operating system has a built-in command:

# Windows (PowerShell)
Get-FileHash ubuntu.iso -Algorithm SHA256
# macOS
shasum -a 256 ubuntu.iso
# Linux
sha256sum ubuntu.iso

Compare the output with the value on the official download page; capital or lowercase letters do not matter. In Python, hashlib does the same check, reading the file in chunks so a 6 GB file never has to fit in memory:

import hashlib
import os
import tempfile

def sha256_of_file(path):
    digest = hashlib.sha256()
    with open(path, "rb") as f:
        # Read 64 KB at a time so large files never fill memory
        for chunk in iter(lambda: f.read(65536), b""):
            digest.update(chunk)
    return digest.hexdigest()

path = os.path.join(tempfile.gettempdir(), "demo.txt")
with open(path, "wb") as f:
    f.write(b"hello world\n")

published = "a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447"
actual = sha256_of_file(path)
print(actual)
print("OK" if actual == published else "Checksum mismatch")

a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447
OK

Change hello world to hello World and run it again: every character of the checksum changes, and the last line says Checksum mismatch.

What is a checksum error?

A checksum error means the check failed: the value calculated from the data you have does not match the value stored or sent with it. Either the data changed or the stored checksum was damaged. The message and the fix depend on where it appears.

CMOS or BIOS checksum error at startup

A PC's firmware (BIOS or UEFI) keeps its settings, such as the boot order and the clock, in a small memory kept alive by a coin cell battery, usually a CR2032, while the computer is unplugged. A checksum of those settings is stored beside them. At every start the firmware recalculates it, and if the values differ it shows a message such as CMOS Checksum Error - Defaults Loaded and falls back to factory settings.

The usual cause is a weak or dead battery, especially when the clock also resets. A power cut while settings were being saved, or clearing the CMOS with a jumper, has the same effect. To fix it:

1. Open the setup screen (usually Delete or F2 while the PC starts), set the date, time and any settings you changed, then save and exit (often F10). If the message does not return, it was a one-time event.
2. If it returns after every cold start, shut down, unplug the computer and replace the CR2032 battery.
3. If the message names the firmware itself, such as BIOS ROM checksum error or Main BIOS checksum error, the firmware image is damaged. Boards with a backup BIOS chip restore it automatically; on others, use the board's BIOS recovery feature or flash the firmware again from the manufacturer's site, without cutting the power during the update.

Checksum mismatch after a download

Your file's SHA-256 does not match the one on the download page. The file may be incomplete or corrupted (an interrupted connection, a full disk), you may be comparing against the checksum of a different file (another version or CPU architecture), or you may be comparing two different algorithms: an MD5 value is 32 hex characters, a SHA-256 value 64. Rarely, the file was tampered with.

Check the algorithm and the file name, then download the file again from the official site. If a fresh copy from the official source still does not match, do not run it. Package managers do this check for you: pip stops with THESE PACKAGES DO NOT MATCH THE HASHES when a downloaded package differs from the pinned hash.

Checksum error in a ZIP, RAR or 7z archive

Archive formats store a CRC-32 of each file's original contents. When you extract, the tool recalculates it; WinRAR reports a mismatch as Checksum error and 7-Zip as CRC Failed. For an encrypted archive, a wrong password produces the same message, because a wrong password decrypts to garbage. Download the archive again, make sure every part of a split archive (.part1.rar, .part2.rar) is present and from the same upload, and retype the password. WinRAR's Repair archive command works best on archives created with a recovery record, and the "Keep broken files" option saves whatever did extract correctly.

Checksum errors in games and network tools

Games compare checksums of their files, so a partial update or a changed file fails the check. In Steam, "Verify integrity of game files" downloads again every file whose checksum does not match. In Wireshark, checksum warnings on packets your own computer sends are usually not real errors: the network card fills in the checksum after Wireshark has already captured the packet.

Common misconceptions

• "A matching checksum proves the file is safe." It proves the file matches the published value. If an attacker controls the website, they can change both, which is why projects also sign their checksum files with a key.
• "A checksum can fix a corrupted file." It only detects the damage. The fix is getting a good copy.
• "Checksum and hash are different things." Checksum describes the job; a hash function such as SHA-256 is one tool that can do it.

Where to go next

Compute MD5, SHA-1 and SHA-256 values of any text in the hash generator. Checksums work on raw data, so what is a byte and what is a bit explain what is actually being added up. A database uses page checksums to catch disk corruption, and the hash table visualization shows another use of a short value calculated from data.