CRC32 Checksum Calculator

What a CRC32 checksum is

A cyclic redundancy check treats the input as one long binary polynomial, divides it by a fixed generator polynomial and keeps the remainder. For CRC-32 the remainder has 32 bits, usually written as 8 hex digits or as an unsigned number from 0 to 4,294,967,295. Almost any change to the data changes the remainder.

CRCs are designed for the errors that real cables, radios and disks produce. CRC-32 detects every burst of corrupted bits up to 32 bits long, and a random corruption goes unnoticed only about once in 4.3 billion cases. It is also very fast to compute, which is why it is built into ZIP, gzip, PNG and Ethernet frames.

CRC-32 and CRC-32C

Both start from 0xFFFFFFFF, process the bits of each byte least significant first and invert the final value; only the polynomial differs, so the same data gives two unrelated results. The first is what most tools mean by "CRC32" and is catalogued as CRC-32/ISO-HDLC. CRC-32C was adopted later by storage and network protocols for its stronger error detection. Google Cloud Storage reports CRC-32C, and Amazon S3 either variant, as Base64 of the four bytes in big-endian order, which is exactly what the Base64 output shows.

A checksum, not a security check

A CRC protects against accidents, not attacks. It is a linear function, so anyone can modify a file and then adjust four bytes to keep its CRC-32 unchanged. A matching CRC therefore proves nothing about deliberate tampering. To check a download, compare a SHA-256 hash from a trusted source; to prove who sent a message, use an HMAC.

32 bits is also too few to identify data. Among about 77,000 random files, the chance that two share the same CRC-32 already reaches 50%, so do not use it as a unique ID or a deduplication key. Where no attacker is involved, MD5 or SHA-256 make far better fingerprints.

CRC32 in code

# Python: zlib.crc32 is unsigned in Python 3;
# "& 0xffffffff" is only needed for Python 2
import zlib
format(zlib.crc32(b'123456789'), '08x')    # 'cbf43926'

// Node.js 20.15+ and 22.2+
require('zlib').crc32('123456789').toString(16).padStart(8, '0')   // 'cbf43926'

// Go (import "hash/crc32")
crc32.ChecksumIEEE(data)                                   // CRC-32
crc32.Checksum(data, crc32.MakeTable(crc32.Castagnoli))    // CRC-32C

// Java: java.util.zip.CRC32, and java.util.zip.CRC32C since Java 9

// PHP
sprintf('%08x', crc32('123456789'));   // 'cbf43926'
hash('crc32b', '123456789');           // 'cbf43926', the same CRC-32
hash('crc32c', '123456789');           // 'e3069283'
hash('crc32', '123456789');            // '181989fc', a different CRC

Watch the names in PHP: the hash algorithm called crc32 is not the ZIP checksum but the CRC used by bzip2, printed in reverse byte order. Use crc32b or the crc32() function to match ZIP, gzip and this tool. The Unix cksum command uses yet another variant that also mixes in the file length, so its number will not match either.