CRC32 vs SHA-256 vs XXHash: Which Checksum Should You Use?
If you've ever needed to verify a download, find duplicate files, or prove a folder hasn't changed, you've met checksums. But which one should you actually use? The answer changes completely depending on what you're doing. The three contenders CRC32 — the old workhorse. Fast, tiny (32 bits), supported everywhere. Built for detecting accidental corruption: bit flips during transfer, truncated…
Checksums are tools used to verify downloads, find duplicate files, and ensure folders haven't changed. Three popular checksum algorithms are CRC32, XXHash, and SHA-256. Each serves different purposes based on the required balance of speed, collision resistance, and trustworthiness of the result.
CRC32 is an old, fast checksum algorithm that's supported everywhere. It's great for detecting accidental corruption like bit flips during transfer or truncated downloads. However, it isn't designed to be collision-resistant, meaning two different files can easily share the same CRC32. Using CRC32 for duplicate file detection, especially for destructive actions like deleting files, isn't advisable. A 1-in-4-billion collision risk is too high for such critical decisions across large media libraries.
XXHash is a fast, non-cryptographic checksum algorithm that's excellent when speed is paramount, and you control the inputs. It's perfect for deduplication and comparing files based on content. However, like CRC32, it's not collision-resistant against deliberate attacks. For destructive actions, XXHash isn't recommended either. The right choice for duplicate file detection should be XXHash or SHA-256 to ensure real collision resistance and prevent deleting the wrong files.
SHA-256 is a cryptographic hash algorithm that's considered the gold standard for proving file integrity. Its collision resistance makes it suitable for audits, legal cases, and backup verification. Unlike CRC32 and XXHash, SHA-256 can't be deliberately manipulated to produce the same hash for different files. It's the best choice when the result needs to stand up to scrutiny or be accepted as evidence in a court of law or compliance setting.
When comparing folders across two machines, SHA-256 is the best choice. Its trustworthy fingerprint ensures that the comparison is reliable over time and across different systems. The mistake many people make is using CRC32 for duplicate file detection. If destructive actions like deleting files are based on matching hashes, a 1-in-4-billion chance of a false positive is not acceptable.
For such critical decisions, always use SHA-256 and treat the hashes as evidence, not just hints. FolderManifest is a tool that simplifies this process by saving folder snapshots with SHA-256 fingerprints, allowing for later verification and generating reports that show exactly what was added, removed, or changed. For quick hashes without installation, there's also a free browser-based checksum calculator available.
The key takeaway is to choose the checksum based on the potential consequences of being wrong, not just the performance benchmarks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
