FluffyBench

What does a checksum or signature prove?

A download's checksum can match perfectly without telling you who made it. Here's what that match proves, and what a signature adds when you trust the publisher's key.

FluffyBench · 4 min read · Reviewed

What is a hash?

A hash is a fingerprint for a file. A hash function reads the file's bytes—the small units of information it's stored as—and produces a fixed-size result called a digest. The same bytes and algorithm give you the same digest every time.

Here's FluffyBench hashed with SHA-256, then FluffyBenck: changing the last letter changes most of the fingerprint.

SHA-256 digests of FluffyBench and FluffyBenck differ; both complete outputs are shown in short rows.

One changed letter, two full digests

  1. FluffyBench

    The first input and its full fingerprint.

  2. FluffyBenck

    The changed input and its full fingerprint.

  3. Changed positions

    Underlines mark characters that differ.

Red underlines mark the 60 of 64 hexadecimal positions that changed; 137 of 256 digest bits differ. How we reviewed

When does a checksum match matter?

A fingerprint becomes useful when you have something to compare it with. A publisher may list a checksum for a download, often a SHA-256 digest. With a well-designed cryptographic hash, a matching digest is strong evidence that your copy has the bytes described by that reference. Finding different files with the same digest is meant to be impractical.

For FluffyBench.txt, the expected digest and the digest calculated from the local file agree. A publisher-style checksum line puts the digest first, then two spaces and the filename.

Illustrative SHA256SUMS-style reference: digest, two spaces, and FluffyBench.txt; the full expected and locally calculated SHA-256 digests agree, giving OK.

Expected and calculated SHA-256

  1. Expected line

    The reference pairs a digest with its filename.

  2. Calculated

    The digest made from the local file.

  3. Comparison

    OK means the full digests agree.

The reference is an illustration made from the included text file, not an authenticated publisher download.

The reference's source matters. Someone who can replace a download and the checksum on its page can make them agree. Your trust in that source is what makes the comparison useful; a match doesn't identify who supplied it.

What does a digital signature add?

A digital signature connects the signed bytes to a signing key. Think of the private key as a seal the publisher holds, and the matching public key as the reference anyone can use to check that seal.

A valid signature means the file's contents match what that key signed. Connecting the public key to the publisher is a separate part of the trust decision.

Schematic: a publisher signs a file with a private key; a verifier checks the downloaded file and signature with the public key. A separate connection links the public key to the publisher's identity.

Signature verification and key ownership

  1. Private key

    Used to create the signature.

  2. Public key

    Used to check the signature.

  3. Key ownership

    The identity connection needs its own trusted source.

With a trusted key-ownership connection, a valid signature is evidence that the publisher approved these bytes.

Doing it in FluffyBench: check a download's checksum

FluffyBench's Hash Checksum compares your local file with an expected digest. Have the publisher's checksum for your exact download version from a source you trust; here's the workflow with FluffyBench.txt.

  1. File tab and Choose file button in FluffyBench Hash Checksum.
    File tab and Choose file button in FluffyBench Hash Checksum.
    Step 1. Use File and Choose file to open your download. FluffyBench reads it on your device.
    1. Use File for a download.
    2. Choose file opens your device’s picker.
  2. FluffyBench.txt selected in the checksum workspace, with its filename and size.
    FluffyBench.txt selected in the checksum workspace, with its filename and size.
    Step 2. Check the filename and size. Choosing a file starts hashing automatically.
    1. Confirm the selected filename and size.
  3. The full expected SHA-256 digest for FluffyBench.txt and the automatic It matches result.
    The full expected SHA-256 digest for FluffyBench.txt and the automatic It matches result.
    Step 3. Paste the digest from your trusted reference into Expected checksum, without the filename. Its length chooses SHA-256 or SHA-512; It matches appears automatically when the values agree.
    1. Paste the expected checksum here.
    2. It matches confirms that the full digests agree.
  4. Completed SHA-256 digest with its Copy button.
    Completed SHA-256 digest with its Copy button.
    Step 4. Copy SHA-256 copies the calculated digest if you need to share it.
    1. Copy SHA-256 copies this result.

A match or a valid signature doesn't establish that software is safe to run. FluffyBench compares digests; it doesn't verify signatures or certificates, identify a publisher, or scan for malware.

If the publisher supplies a signature, follow their verification instructions using a public key you can connect to them. That's a separate check outside FluffyBench.

If the digests differ, the selected file, algorithm, or reference may belong to a different download or version. A length or hexadecimal-character error means the pasted reference isn't a usable digest; the filename doesn't belong in Expected checksum.

Compare your download with FluffyBench's Hash Checksum

Search FluffyBench