r2modman checksum verifier: verify SHA-512 downloads

What an r2modman checksum verifier can prove

The r2modman checksum verifier answers one narrow question: do these bytes match the digest published for this exact file? A SHA-512 value is a content fingerprint. If your result matches the value listed for that specific version and asset, the download is complete and unaltered. It proves nothing about what the program does, whether running it is a good idea, or whether any third-party mod is trustworthy. A digest is also specific in both directions: a value published for one version says nothing about a different build, and a value for one asset says nothing about another file from the same release.

• A match means the bytes equal the published digest.
• A digest says nothing about program behaviour.
• Published values cover release assets, not third-party mods.

Run the verification step by step

Select the file you downloaded in the tool on this page. Your browser reads it locally and produces a SHA-512 digest in both hexadecimal and Base64, so you can use whichever format the published entry uses. Copy the value and compare it character for character with the download center entry for the same asset. Filename, version, algorithm, and encoding must all match. A SHA-256 value will never equal a SHA-512 value, and a hexadecimal string will never equal a Base64 one. The v3.2.19 release publishes a value for five of its eight files: the Setup installer, the AppImage, the deb, the rpm and the pacman package. The portable .exe, the tar.gz and the Flatpak have none, so for those compare the byte size instead.

Published SHA-512, Base64 (v3.2.19)

r2modman-Setup-3.2.19.exe (165,156,122 bytes)
ryBCak935X0THtS01TMCEHhI617R/JN39mJuSKrykyuZQXyrHoecjgZE2kV30vXqqrCisxWl4KJuuXuiYqaP+Q==

r2modman-3.2.19.AppImage (200,488,834 bytes)
6aMz/QZaZva3a2KGfCp+1XcxMFV7A+rKRAqYeILqYkmaG9WAmjyq5n3i6scSYmfUnNYdaTWXWYTGWdkpW2vPyQ==

r2modman_3.2.19_amd64.deb (154,752,116 bytes)
fu9CbDFV9Pncd7G8iEmWqdf1+fYoJkkSfH85FDgJP3Ot4Tkl6t9EDrWanErpm/7S5E7WtqNi5l7/7FtgC7diOQ==

r2modman-3.2.19.x86_64.rpm (139,615,825 bytes)
TyTyJ7mKGr2TD1Lm6viWIME5JdoLVx651EpD1X8Ur8CRPvY3znxeG2EybVlY0SNwYfKJmFdaAC+ntOJtTcYNOg==

r2modman-3.2.19.pacman (141,597,372 bytes)
FjUNnaiW03gba4eOGRXCXe05siduSOpGmXxOk1BqR+kHZ33bSbQMJHXC0T+Cj99R2e7m8qKIIXCuN3OWf0KxpQ==

No published digest: r2modman-3.2.19.exe, r2modman-3.2.19.tar.gz, r2modman.flatpak

• Select the downloaded file in the tool on this page.
• Compare against the matching entry in the published list below.
• Filename, version, algorithm, and encoding must all match.

What happens to the file you select

Nothing leaves your machine. The tool uses the browser File API to read the selected file and the Web Crypto API to hash it, so the bytes are never uploaded to a server and the result exists only in the current page session. Reloading or closing the page discards it. Hashing is a read-only operation, so the verifier cannot modify, move, or delete the file you choose. Because the whole file has to be read, a large AppImage takes noticeably longer than a small installer, and on limited hardware you should let the tab finish rather than switching away mid-calculation.

• No upload: hashing happens inside the browser.
• The result disappears when the page is reloaded.
• Large AppImage files take longer because the whole file is read.

When your checksum does not match

A mismatch almost always means an incomplete download. Delete the file, confirm you have enough free disk space, and download the same asset again rather than trying to repair the existing copy. Do not rename, recompress, extract, or edit a file before comparing it, because any content change correctly produces a different digest. Check that you are comparing against the entry for the same filename and version in the published list, and that the algorithm and encoding match. If repeated downloads of the same asset keep producing different values, stop and verify the release information before running the file at all.

• Delete the file and re-download the exact asset.
• Never edit or recompress a file before hashing it.
• Compare only against the matching entry in the published list.

What a checksum cannot tell you

A matching digest is evidence about bytes, not about intent. It confirms that a file is the one the release published. It does not audit what that program does at runtime, and it does not extend to community mods, which have their own authors, sources, and review processes. Use the verifier to rule out a corrupted or substituted download, then make separate decisions about provenance for everything else you install. If a mod behaves unexpectedly, that belongs with the mod's own documentation and issue tracker rather than with a hash comparison.

• Integrity and trust are separate questions.
• A digest does not describe runtime behaviour.
• Third-party mods have their own provenance to verify.