I have one file. SHA-1 and MD5 have been generated long time back. I do not know which tool has been earlier.

Recently I generated SHA-1 & MD5 for the same JAR. Surprisingly I found that MD5 is same both the times but SHA-1 is different.

How is it possible?

Thanks in advance.

  • 1
    Only if somebody deliberately prepared the file (before the first hashing) to have that property. Commented Oct 1, 2015 at 13:31
  • Try sha1 of file as text and as binary, maybe that is the difference.
    – Z.T.
    Commented Oct 1, 2015 at 18:28

3 Answers 3


Can a file has same MD5SUM and different SHA-1 from different tools?

If the file has not in fact been changed in the meantime?

No. Not if both old and new hashsumming tools are correctly implemented. (I.E. if they are implemented according to the MD5 and SHA1 standards.)

I suspect (in fact I'm short of betting) that the earlier checksum was just misdocumented.

  • File did not change. I am not sure whether SHA-1 has been mis-quoted or not. Commented Oct 1, 2015 at 12:08
  • Yes it can - mathstat.dal.ca/~selinger/md5collision
    – Natanael
    Commented Oct 3, 2015 at 18:36
  • @Natanael: But we're not talking about two files. Commented Oct 3, 2015 at 18:51
  • The other possible solution is that the sha1 tool has a serialization or encoding error
    – Natanael
    Commented Oct 3, 2015 at 19:06
  • Finally I have found that SHA-1 and SHA-256 hashes are interchanged and SHA-1 was misquoted. Commented Oct 4, 2015 at 3:57

MD5 and SHA-1 checksums represent the fingerprints of your file. As for an individual, the fingerprint does not change naturally. These checksums do not depend on the software or platform you use (as long as the related RFC is properly implemented)

I suggest you to visit this interesting page (Comparison of file verification software) and check Program features section to be check if you are comparing the same checksum output formats.


If created intentionally to do so, yes: http://www.mathstat.dal.ca/~selinger/md5collision/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .