How-To: Check an MD5 Hash

[Rob Williams]

An MD5 hash is a value based on an advanced cryptographic algorithm and has multiple uses. One of the most common is the storing of a password in an encrypted format. Our forums, and most other websites, will base encrypted passwords in MD5 since it's rather difficult to crack.

Another popular use is to check the integrity of a file. The premise is simple. Someone sends you a file along with an .MD5. Inside that MD5 file is a string of characters that represent the MD5 output after analyzing the file. If you check the hash of the file once you received it and the strings match, then you can be confident that you received an exact duplicate.

This is popular in the Linux world, since most distros include a digest file or post all of the MD5s on the site. Where it comes in handy is knowing that the file you downloaded is perfect. If the hash differs, then problems will likely arise when installing. Not always, but most often.

Though a popular task, many people still don't know how to properly check for an MD5 hash, so I thought a quick how-to would be appropriate.

First thing is downloading an MD5 checker. If you are in Linux or Mac OS X, you probably already have one installed. But if in Windows, you'll need to download md5sum.exe and copy it to your C:\Windows\System32 folder.

MD5sum Executable

Once that file is copied to \Windows\System32, it will be executable from the command-line. If you do not copy the file to \System32\, you will have to keep that executable in the same folder as the file you want to check.

So you downloaded the latest Ubuntu, but your Internet connection sucks. You want to make sure that the downloaded copy is a good one before risking your system with it. The first thing you want to search for is the MD5 hash, which most distros will post somewhere. In the case of Ubuntu, they can be found here:

https://help.ubuntu.com/community/UbuntuHashes

You then check the MD5 hash posted, and then check your own with:

md5sum ubuntu-8.04-desktop-amd64.iso

You of course replace the filename with the one you want to check. If you happen to have a .digest or .md5 with your download, you'd run a command like this:

md5sum -c ubuntu-8.04-desktop-amd64.DIGEST

That will compare the MD5 hash inside of the file to the ISO file you've downloaded and tell you if it's ok.

There you have it. Checking an MD5 couldn't be easier. Here is a direct screenshot to show the process: