One question, one answer

Hash 1.04 does a single thing: it reads a file and reports its fingerprint — the fixed-length value that changes if a single byte inside the file changes. The version described here is 1.04. It is free, it is small, and there is no project management, no queue and no account to set up before the first answer arrives.

The question it answers comes up more often than people expect. A file arrives over a network and you want to know whether it arrived intact. Two copies of the same document sit on two machines and you want to know whether they are really identical, as opposed to identical by name and date. Someone sends you a value and says the file should match it, and you want to check that without opening anything.

Three algorithms in the same window

The program reports MD5, SHA1 and CRC32 for the same file. They come from different eras and they are not interchangeable, which is why seeing all three at once is useful rather than redundant.

CRC32 is the oldest and the shortest: thirty-two bits, built to catch transmission and storage errors rather than to prove anything about intent. It is the right instrument when the question is whether a copy survived the trip, and the wrong one when the question is whether someone could have produced a different file that reads the same.

MD5 and SHA1 sit in between. Both were designed for integrity checking, and both are still published next to files, which is the practical reason to keep computing them: matching the value somebody printed is the only way to use that value. Neither is a sound choice against an adversary — collisions have been demonstrated for both — and a tool that computes them is not thereby a security tool.

The two fields that are not hashes

Alongside the checksums, the file size and the last modification date are shown. Those two look like filler and they are not. A hash tells you whether two files are identical byte for byte; size and date tell you at a glance whether a comparison is worth starting, and they are what you read when you are trying to remember which of several copies is the one you meant to keep.

Deciding what to compute

The columns to be generated are chosen before any file is added: version information, date, MD5, SHA1 and CRC32 are each a box that can be left unticked. Computing a value that nobody will read is wasted work on a large file, and a table of five columns where two would do is harder to read than the same table with two. Making that choice explicit is a small design decision that says something about who the program expects to be using it.

More than one file at a time

Files are added by dragging them into the window, or by importing a batch, and the values are produced for the whole set in a single pass. That matters more than it sounds. The job this tool gets used for is rarely about one file: checking a folder of installation media, or comparing two directories that are supposed to hold the same content, is the ordinary case, and a program that demanded one window per file would be abandoned at the third one.

Where it fits, and where it does not

The honest summary is that Hash 1.04 is a reader, not a verifier. It does not decide whether a value is correct and it does not check a signature; it prints the numbers and leaves the comparison to the person reading them. For a utility this size that is the right division of labour, and it is also why the program needs no configuration. It is not a forensic tool either: it reads files through the operating system, so a file it cannot open is a file it cannot hash.

For the everyday version of the question — is this the same file, did this arrive intact — one window, three algorithms and a place to drop things is the whole of what is needed. Hash 1.04 is free, and it is the kind of utility that ends up pinned somewhere and used for years without being thought about again.