xxHash vs CRC32 vs SHA-256: Which Checksum Should You Use?
Compare xxHash, CRC32 and SHA-256 for speed, collision risk, duplicate detection and file-integrity verification. See which algorithm fits each workflow.
Founder of ARCED Foundation, ARCED International, and Solutions of Things Lab (SoTLab). Built FolderManifest to help teams protect file integrity and stay audit-ready.
Choose xxHash for speed-focused work, CRC32 for compatible error detection, and SHA-256 for tamper-sensitive integrity verification. Throughput varies by hardware, implementation, input size, storage, and the specific xxHash variant, so benchmark your real workflow before optimizing for speed.
xxHash vs CRC32 vs SHA-256 Comparison
| Factor | xxHash | CRC32 | SHA-256 |
|---|---|---|---|
| Speed | Designed for very high throughput; variant and implementation matter | Very fast; CPU instructions can improve performance | Usually slower, though hardware acceleration can narrow the gap |
| Bit length | 32, 64, or 128 bits, depending on variant | 32 bits | 256 bits |
| Accidental collisions | Lower with 64/128-bit variants than CRC32 | Highest risk here because the output is only 32 bits | Negligible for practical file collections |
| Malicious collision resistance | No | No | Yes; designed as a cryptographic hash |
| Deduplication | Good for fast candidate matching; confirm important matches | Usable for small trusted sets; confirm matches | Best for high-confidence content matching |
| Integrity and audit use | Not tamper-resistant | Accidental corruption only | Recommended for tamper-sensitive records |
| FolderManifest support | Not currently supported | Supported | Supported and recommended |
xxHash vs CRC32: Which Is Better?
xxHash and CRC32 are non-cryptographic checks. Both prioritize speed over protection from a deliberate attacker. The important difference is output space: CRC32 is fixed at 32 bits, while commonly used xxHash variants produce 64-bit or 128-bit values. Those wider variants reduce accidental-collision risk for large datasets.
xxHash is often the better candidate for high-throughput caches, indexes, and duplicate pre-screening. CRC32 remains useful when a file format, archive, protocol, or existing manifest already expects CRC32. Hardware-accelerated CRC32 can also be highly competitive, so “xxHash is always faster” is not a reliable claim.
Neither xxHash nor CRC32 proves authenticity.
If an attacker can choose the input, use SHA-256 and obtain the expected value from a trusted source.
CRC32 vs SHA-256 for File Integrity
CRC32 is an error-detection code. It is effective for catching random corruption in storage and transmission, but its 32-bit output is small and an attacker can deliberately engineer matching values.
SHA-256 is a cryptographic hash with a 256-bit output. Use SHA-256 for downloaded software, backup evidence, audit records, release artifacts, or any checksum that must remain meaningful when deliberate tampering is possible. The file-integrity guide explains how to compare a calculated checksum with a trusted value.
How Collision Risk Changes the Decision
A collision occurs when different inputs produce the same output. Collision risk rises as a collection grows, so a 32-bit checksum can collide sooner than the “one in billions” shorthand suggests. A 64-bit or 128-bit xxHash gives more room for accidental uniqueness, while SHA-256 provides a vastly larger output space and cryptographic collision resistance.
For deduplication, a fast non-cryptographic hash can identify candidates, but important matches should be confirmed with SHA-256 or a direct byte comparison. For an audit or security decision, start with SHA-256.
Best Uses for Each Algorithm
Use xxHash for
- Fast cache and index keys
- Large-scale duplicate pre-screening
- Trusted internal pipelines
Use CRC32 for
- Archive and protocol compatibility
- Accidental transfer-error detection
- Existing CRC32 manifests
Use SHA-256 for
- Untrusted downloads
- Audit and compliance evidence
- High-confidence deduplication
FolderManifest Checksum Support
FolderManifest currently supports CRC32 and SHA-256 for folder manifests and verification. xxHash is not currently supported. The free checksum calculator generates SHA-256, MD5, SHA-1, and CRC32 for one file.
Need repeatable folder verification?
FolderManifest compares whole folders locally and saves HTML reports you can review again later.
Frequently Asked Questions
- Is xxHash faster than CRC32?
- Often, but not always. Optimized xxHash variants are designed for very high throughput, while CRC32 may use dedicated CPU instructions. Actual speed depends on the variant, hardware, implementation, file size, storage, and runtime.
- Is xxHash safer than CRC32 for deduplication?
- A 64-bit or 128-bit xxHash gives a much larger output space than 32-bit CRC32, reducing accidental collisions. Neither algorithm protects against deliberate collision attacks, so confirm important matches with SHA-256 or a byte comparison.
- Should I use CRC32 or SHA-256 for file integrity?
- Use CRC32 to detect accidental corruption in trusted transfers or storage. Use SHA-256 when the checksum must also resist deliberate substitution, support an audit trail, or verify an untrusted download.
- Does FolderManifest support xxHash?
- FolderManifest currently supports CRC32 and SHA-256 for folder manifests and verification; xxHash is not currently supported. The free checksum calculator generates SHA-256, MD5, SHA-1, and CRC32.
Need the legacy comparison too? Read what an MD5 checksum is and how MD5 compares with SHA-256.