Choose the integrity mechanism from the threat model
Tool Factory connects file and text digest tools with comparison, identification, and explanation pages. The collection keeps algorithm choices visible and separates integrity checks from password hashing, message authentication, and encryption.
| Mechanism | What it provides | What it does not provide |
|---|---|---|
| Non-cryptographic checksum | Fast detection of many accidental changes. | Resistance against a deliberate attacker. |
| Cryptographic hash | A fixed-length digest designed for security properties. | Proof that a published digest came from a trusted source. |
| HMAC | Keyed message authentication for parties that share a secret. | Public verification or confidentiality. |
| Password hashing | Slow, salted password-verifier derivation with controlled cost. | General file integrity or reversible encryption. |
| Digital signature | Publicly verifiable integrity and signer-key evidence. | Confidentiality unless encryption is also used. |
How to complete this task
- Obtain the trusted digest. Get the expected value and algorithm through an authenticated publisher channel.
- Select the same algorithm. A SHA-256 result cannot be compared with an MD5 or SHA-3 result.
- Hash the exact bytes. Use the downloaded file without opening, rewriting, or normalizing it first.
- Compare every character. Treat case only as the selected representation permits, and reject any value difference.
- Interpret the result narrowly. A match connects the bytes to the trusted digest, not to a safety guarantee.
Common use cases
Software download verification
Compare a local file digest with a value published through a trusted project channel.
Data-transfer troubleshooting
Calculate both endpoint digests to detect byte changes during storage or transport.
Duplicate-content checks
Use matching digests as a fast equality candidate, then preserve collision requirements appropriate to the risk.
Evidence and standards
- NIST Hash Functions project: NIST describes approved hash algorithms as mappings from arbitrary-length messages to fixed-length digests.
- NIST FIPS 180-4: FIPS 180-4 specifies SHA-1 and the SHA-2 family, including SHA-256 and SHA-512 variants.
- NIST FIPS 202: FIPS 202 specifies the SHA-3 family and the SHAKE extendable-output functions.
- RFC 6151: RFC 6151 updates the security considerations for MD5 and HMAC-MD5 applications.
- NIST SHA-1 transition guidance: NIST announced a transition away from SHA-1 and recommends stronger SHA-2 or SHA-3 alternatives for security applications.
Important limits
- The expected digest is useful only when its delivery channel is trusted.
- A matching digest does not scan a file for malicious behavior.
- Algorithm suitability depends on accidental-error, adversarial, authentication, or password-storage requirements.