Hashes, checksums and password storage: different jobs

Match the goal

A checksum helps detect accidental corruption. A cryptographic digest is designed with stronger properties, but it still has no secret key.

If an attacker can replace both a download and its published checksum, matching the checksum does not prove the publisher’s identity.

Hash exact bytes

An extra newline changes the digest. Text encodings and Unicode normalization can change bytes even when two strings look similar.

Use the short abc vector to verify SHA-256, then compare the file itself rather than a copied text representation.

SHA-256("abc")
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad

Avoid fast digests for passwords

SHA-256 is deliberately fast and is not a password storage scheme. Password hashing requires an appropriate work factor and salt.

Use an established password hashing implementation such as Argon2id or an appropriate supported alternative. Nav Tools bcrypt is a test utility, not an account backend.

Know legacy boundaries

MD5 and SHA-1 are not appropriate where collision resistance is needed for security. They may still appear in legacy checksums or protocol compatibility work.

For authentication of a message, use a protocol-appropriate MAC or signature. A bare hash does not tell you who produced the data.