The question a checksum answers
A checksum answers one thing: is the file you just downloaded the file the publisher built? Change a single byte and the hash changes completely, so a matching value means nothing was lost in transit and nothing was swapped along the way. A value that does not match is not a small problem. Do not open the file, download it again, and if the second copy fails too, get it elsewhere.
Where the published hash lives
Most projects put a SHA256SUMS file next to the download, one hash per released file. GitHub releases carry the values in the release notes or as an extra asset, Linux distributions keep them beside the ISO, and container registries print a digest that starts with sha256:.
A hash from the same place proves less
If the file and its hash come from one server, anyone who could replace the file could replace the hash on the same visit, and the two would agree perfectly. That is why serious projects sign the sums file: alongside SHA256SUMS sits SHA256SUMS.gpg, signed with a key published separately. Check the signature first, then trust the sums inside. Without one, a hash from another channel — a mailing list, a package manifest, a vendor’s documentation — beats the one lying beside the file.
Why MD5 and SHA-1 are still around
Both are broken where it matters for security: two different files with the same MD5 can be constructed in practice, and SHA-1 collisions have been demonstrated on real documents. Neither proves that nobody tampered with a file. What they still catch are accidents: a truncated download, a bad disk, a stale mirror. Older projects often publish only an MD5, and comparing that beats comparing nothing. When SHA-256 is offered too, use it.
Why the formatting varies
The digest is just a number, so everyone writes it differently. Case varies and is ignored here, since the value is the same. Registries put the algorithm in front, as in sha256:. The sha256sum command prints the hash, two spaces and the file name, while openssl dgst puts the name first and the hash after an equals sign. Paste any of those and the hash is pulled out of the line.