If you've ever needed to verify a download, find duplicate files, or prove a folder hasn't changed, you've met checksums. But which one should you actually use? The answer changes completely depending on what you're doing.
The three contenders
CRC32 — the old workhorse. Fast, tiny (32 bits), supported everywhere. Built for detecting accidental corruption: bit flips during transfer, truncated downloads. It was never designed to be collision-resistant — two different files can easily share a CRC32.
XXHash — the speed demon. Non-cryptographic, extremely fast (GB/s on modern CPUs), excellent distribution. Perfect when you need speed and you control the inputs. But like CRC32, it's not collision-resistant against deliberate attacks.
SHA-256 — the auditor. Cryptographic hash: finding two files with the same hash is computationally infeasible. Slower than the others (though hardware acceleration has narrowed the gap), and the right answer whenever the result needs to prove something.
A quick decision table
- Detecting accidental transfer corruption? CRC32 or XXHash — fast is fine
- Finding duplicate files by content? XXHash or SHA-256 — you need real collision resistance so you don't delete the wrong file
- Proving file integrity for an audit, legal case, or backup verification? SHA-256, always. A court or compliance team won't accept CRC32
- Comparing folders between two machines? SHA-256 — the fingerprint has to be trustworthy across time and systems
The mistake most people make
Using CRC32 for duplicate-file detection. If you're about to delete files based on matching hashes, a 1-in-4-billion collision chance is not the safety margin you want — especially across large media libraries where similar-looking files abound. For anything destructive, use SHA-256 and treat hashes as evidence, not hints.
Doing this at folder scale
Single files are easy (certutil -hashfile on Windows, sha256sum on Linux). The hard part is whole folders: thousands of files, re-verification over time, and producing a report someone else can read.
That's exactly what we built FolderManifest for — save a folder snapshot with SHA-256 fingerprints, verify later, and get a report showing exactly what was added, removed, or changed. There's also a free browser-based checksum calculator if you just need a quick hash without installing anything.
TL;DR
- CRC32: speed, corruption checks, compatibility
- XXHash: maximum speed for dedup and comparisons
- SHA-256: proof, audits, anything destructive or legal
Pick based on the consequence of being wrong — not on benchmarks alone.
Top comments (0)