CRC32 vs SHA-256 vs XXHash: Which Checksum Should You Use?

Mehrab Ali — Sat, 29 Aug 2026 11:30:40 +0000

If you've ever needed to verify a download, find duplicate files, or prove a folder hasn't changed, you've met checksums. But which one should you actually use? The answer changes completely depending on what you're doing.

The three contenders

CRC32 — the old workhorse. Fast, tiny (32 bits), supported everywhere. Built for detecting accidental corruption: bit flips during transfer, truncated downloads. It was never designed to be collision-resistant — two different files can easily share a CRC32.

XXHash — the speed demon. Non-cryptographic, extremely fast (GB/s on modern CPUs), excellent distribution. Perfect when you need speed and you control the inputs. But like CRC32, it's not collision-resistant against deliberate attacks.

SHA-256 — the auditor. Cryptographic hash: finding two files with the same hash is computationally infeasible. Slower than the others (though hardware acceleration has narrowed the gap), and the right answer whenever the result needs to prove something.

A quick decision table

Detecting accidental transfer corruption? CRC32 or XXHash — fast is fine
Finding duplicate files by content? XXHash or SHA-256 — you need real collision resistance so you don't delete the wrong file
Proving file integrity for an audit, legal case, or backup verification? SHA-256, always. A court or compliance team won't accept CRC32
Comparing folders between two machines? SHA-256 — the fingerprint has to be trustworthy across time and systems

The mistake most people make

Using CRC32 for duplicate-file detection. If you're about to delete files based on matching hashes, a 1-in-4-billion collision chance is not the safety margin you want — especially across large media libraries where similar-looking files abound. For anything destructive, use SHA-256 and treat hashes as evidence, not hints.

Doing this at folder scale

Single files are easy (certutil -hashfile on Windows, sha256sum on Linux). The hard part is whole folders: thousands of files, re-verification over time, and producing a report someone else can read.

That's exactly what we built FolderManifest for — save a folder snapshot with SHA-256 fingerprints, verify later, and get a report showing exactly what was added, removed, or changed. There's also a free browser-based checksum calculator if you just need a quick hash without installing anything.

TL;DR

CRC32: speed, corruption checks, compatibility
XXHash: maximum speed for dedup and comparisons
SHA-256: proof, audits, anything destructive or legal