Checksum verification for camera media: xxHash vs MD5 vs SHA-256 vs C4
When you offload a card properly, the tool doesn’t just copy the files — it computes a checksum of each one at the source and again at the destination, and compares them. If they match, the copy is bit-for-bit identical. If they don’t, you have a problem you can catch now, while the card still exists, instead of in post.
Here’s what the common algorithms are and when each makes sense.
What a checksum is
A checksum (or hash) turns a file’s contents into a short, fixed-length fingerprint. Change a single bit and the fingerprint changes completely. So if the source file and the copied file produce the same checksum, they’re the same file. This is the whole basis of verified offload — and of ASC MHL, which just records those checksums in a standard file.
xxHash — the fast default
xxHash (including XXH3 and XXH64) is a non-cryptographic hash built for speed. It’s extremely fast — fast enough that verification barely slows the offload — and for detecting accidental corruption during a copy, it’s exactly the right tool. For on-set offload, where you’re guarding against dropped bits and flaky readers, xxHash is the sensible default.
MD5 — the legacy standard
MD5 is older and slower than xxHash, and it’s cryptographically broken (you shouldn’t rely on it for security). But it’s everywhere: many facilities and delivery specs still ask for MD5 because their downstream tools expect it. As a corruption check for offload it’s perfectly fine; you’ll mostly use it because someone downstream requires it.
SHA-256 — when a spec demands it
SHA-256 is a cryptographic hash: slower again, but collision-resistant in a way MD5 is not. Some studios, archives and legal/chain-of-custody workflows require it. If your delivery spec says SHA-256, use SHA-256 — otherwise the extra cost buys you nothing on set.
C4 — content-addressable IDs
C4 (the SMPTE C4 ID) is a hash formatted as a universal, content-addressable identifier: the same content always yields the same C4 ID, anywhere. It’s used in asset-management and archive workflows where files need a stable, global name independent of filename or location.
Which should you use?
- On set, general use: xxHash — fast, and catches what actually goes wrong during a copy.
- A facility or delivery spec asks for MD5 / SHA-256 / C4: use what they ask for.
- The point isn’t the algorithm — it’s that verification happens at all, by reading the copy back.
Olycen supports all of these — xxHash, MD5, SHA-256 and C4 — and records your choice in an ASC MHL v2 manifest on every offload, so the proof travels with the footage. See the features or join the beta.
Keep reading: What ASC MHL is, and why your offload should write it · How do you know a camera card copied correctly?
Offload that never lies to you.
Olycen copies every card to as many drives as you want, verifies each file by reading it back, and only says the word verified once the proof is in. One-time $129, two Macs, no subscription — the launch list pays $99.