What is a checksum — and how to check a file downloaded intact

There's a checksum in your wallet. It's the last digit of your card number.

That's why a website catches a typo before it ever asks the bank. It doesn't know your balance. It just added up the digits and saw that can't be right.

You can use the same trick on a 7 GB model that took half the night to download. Here's how.

What is a checksum?

A checksum is a short value computed from data. Change the data and the value changes too.

The sender computes the value and publishes it next to the file. You compute the same thing on your side and compare. A match means the file arrived undamaged. No match means something broke along the way.

Key detail: you're not comparing files. You're comparing two short strings. So nothing needs downloading again.

How it works

There are three levels, from simple to strong.

The Luhn algorithm, for card numbers. Digits are added by a simple rule, and the sum has to divide by 10. I tried it on the test card 4242 4242 4242 4242: it passes. Change the last digit and it fails. Swap two neighbors and it fails too. Those are exactly the typos people make.

CRC, for archives and networks. A quick, short code. It sits in every zip file and every Ethernet frame. It catches random glitches, but it's easy to forge.

SHA-256, for files and packages. This one is a cryptographic hash. See what it does with a one-letter difference:

$ printf 'hello world\n' | sha256sum
a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447  -
$ printf 'hello World\n' | sha256sum
0c23d0ceae909c42439cbb3069887888cb829f6c9d2c93966c944c65a6b6ed59  -

One capital letter, and there's no resemblance at all. That's why comparing the start and end of the string by eye is enough.

How to check a downloaded file

Compute the sum on your side:

# Linux
sha256sum model.safetensors

# macOS
shasum -a 256 model.safetensors

# Windows PowerShell
Get-FileHash model.safetensors -Algorithm SHA256

If the project ships a file of sums, it's one command:

sha256sum -c SHA256SUMS

The answer is model.safetensors: OK or FAILED. I added one character to a file and got FAILED with exit code 1. So you can drop this into a script: the exit code stops the chain for you.

Only have the sum as text on a page? Don't compare 64 characters by eye, hand it to the terminal:

echo "a948904f…a447  model.bin" | sha256sum -c -

Put the full sum in place of the dots. There are exactly two spaces between the sum and the filename. And Get-FileHash on Windows prints capital letters; it's the same sum.

Here's the AI-specific case. Hugging Face stores large files through LFS and publishes their SHA-256:

curl -s https://huggingface.co/api/models/openai/whisper-tiny/tree/main

In the response, model.safetensors has an oid field. For whisper-tiny it's 7ebd0e69e7…2395. That's the file's SHA-256. Download the model, compute the sum, compare. You'll see a 95% cutoff right away instead of after an hour of baffling load errors.

Where you already meet them

You use checksums every day without seeing them:

• package-lock.json has an integrity field for each package. npm checks it on install and fails on a mismatch. A common cause of install errors.
• A script tag with integrity: the browser won't run a file from a CDN if it changed.
• Git: a commit ID is a hash of its whole content. That's why history can't be quietly swapped.

What it won't save you from

Here's the most common mistake. A checksum protects against accidental damage. Against an attacker, only if it came from somewhere else.

Think about it. A hacker breaks into a site and swaps the file. The checksum sits on the same site. What stops them from swapping that too?

In February 2016 the Linux Mint site was hacked this way: the download link led to an image with a backdoor. Checking the sum only helped if you compared against a source the attack hadn't touched.

So the rule is simple:

• Worried about a broken download or a bad disk? A sum from the same site is fine.
• Worried about tampering? Get the sum through another channel, or verify a digital signature, for example with GPG.

Are a checksum and a hash the same thing?

Nearly. A hash is a way of computing; a checksum is what you use it for. CRC counts as a checksum but isn't a cryptographic hash.

Can I still use MD5?

For catching accidental damage, yes, it's fast. For protection against forgery, no: collisions can be made on purpose. If you have the choice, use SHA-256.

Why check if the download finished without errors?

A browser doesn't always notice a cutoff, especially with large files and proxies. A 7 GB file is worth one verification command.