Keep it clean
If you believe that a wish duplicates another one or is not meant for the category, use Options button above to report a duplicate or spam.
Add your wish
If there is an item you wish to have on GOG.com and it’s not yet on the wishlist, please add your wish
My Account - Provide checksums (eg. md5, sha1 etc.) for downloadable files
Added by
triplett Provide checksum information of some sort (md5, sha1, ...) for game installers and the other downloadables. This would provide a way to check if downloaded files match the latest available versions (though an explicit version number would accomplish the same) and a way to validate file integrity in case of a local hardware failure.
Blinkenlight @xmanacollectorx seriously, you are my hero! Thank you SO MUCH for this, especially since the old "append xml to download link" method doesn't seem to work anymore; and this is SO much neater!
xmanacollectorx I have written a userscript to implement display of checksums in the web game collection (gog.com/account):
openuserjs.org/scripts/xmanacollectorx/GOG_Checksum_Lookup
ManiacalMojo7 I would definitely include SHA256 hashes as well, as many have pointed out that md5 and sha1 have been broken. I'm willing to download files twice or even three times, hash both/all and compare the copies just to make sure I'm not getting corrupted files. This puts unnecessary strain on GOG's servers (especially when I am downloading larger games), and obviously takes me (the consumer) longer before I can play my game. This hurts us both, GOG, for such an easy to implement practice. Please fix this.
minigogger Very nice that the installer does check the files before installing, but, it would be better, if I could manually verify every 4GB part immediately after download. I suggest BLAKE2 checksum (b2sum is in GNU coreutils).
vangro Especially for the largest files.
badon With MultiPar my Good Old Games (GOG) will never become Damaged Old Games (DOG). Complete correct data can always be recovered. I use 10% redundancy with MultiPar. MultiPar works on Linux, FreeBSD, etc with Wine. Here is MultiPar:
https://www.livebusinesschat.com/smf/index.php?board=396.0
Don't go to multipar.eu, it is distributing malware. There is no PAR3 - there is only PAR2.
Some other essential data integrity software, Corz Checksum is the fastest:
corz.org/windows/software/checksum/
HashCalc is the easiest for 1 file:
www.slavasoft.com/hashcalc/
aitrumak At this point only SHA2 and SHA3 algorithms should be used (preferably both), as MD5 and SHA1 are broken.
Also, having version numbers easily visible is something which is sorely lacking, especially with games like Niche where the latest version for the Steam release (1.0.2 currently) may be different than the latest GOG release (1.0.1 currently).
@nukeslion - I really don't see how verifying downloads affects piracy in the slightest.
nukeslion Unfortunately this would make piracy much more safe so I can't blame them if they don't. The best solution would be to have people maintain that wiki.
##@@##@@ This seems like it should be a quick and simple update. Come on GOG.
jsbrigo I agree... come on GOG.COM it's 2017
Kerebron 5 years have passed and still no joy... :/
But there are more important things to do, like new, illegible font on the forum, for example. :>
maxiantor Please. My backup version differs from another version, Being under linux currently and having no checksum I don't know which of the two files is broken.
ConnieThunder A yes from me.
At least I'll have easy verification:
My GOG.com Files - bit.ly/1SDy4hH
teerl This would be very helpful for my purposes too. MD5 and SHA1 hashes would be trivial to generate.
GameMaster_83 We need checksums for everything please, these very frequent corrupted downloads is getting a tad obnoxious.
dogfooddiner btw, checked the wiki, md5s are listed but my game isn't -_-
dogfooddiner yes please, sooner the better. bought my first GOG titles today and was surprised there is no easy way to check file integrity!
joveian Downloads being http only with no checksums from a https page is a major security issue; someone who can intercept traffic to gog can replace a game download with a version that completely compromises system security (e.g. adds your system to a botnet), but still installs the game and appears to work fine. This interception is very easy if the game is downloaded over public wifi and potentially (but not necessarily) much harder in other situations. So hopefully it would still be difficult for most downloads, but still this is not something that a software distributor should ever allow to happen.
HTTPS downlods would completely solve this issue, or a secure checksum available from a HTTPS page. SHA-256 or SHA-512 would be the most common secure checksum; I think all supported oses should come with a built in command line tool to check them (at least win 7 and above, linux, and os x) and there are multiple free gui apps for windows as well. A faster alternative would be blake2 (faster and more secure than MD5), and there is at least one free windows gui app available that supports it, but it is still less commonly supported. The resource authentication stuff being added to html might eventually support this, but IIUC the current form that browsers just recently added support for does not yet work for this case.
reofarp I was really shocked to see neither https nor checksums properly implemented. You can manually obtain the xml with the md5 checksum but even that file can only been retrieved over http.
HeyG At least on Linux this is not necessary. When I run a GOG installer from the Terminal, I get following output:
Verifying archive integrity... All good.
Uncompressing Dreamfall Chapters (GOG.com) 100%
So the Installer checks the File.
DMDeck16 GOG, please add SHA1 and/or MD5 checksums for all dmg/exe files, and preferably all downloadable content. They are required to ensure that downloads have been received intact.
crystall Please do provide checksums for the files available for download. They're large and it's quite important to be able to verify they're intact even before installation. Everybody is doing it nowadays including Microsoft so there's no excuse for not having them on GoG.
Lin545 Damn YES! Even without Galaxy, only checksums GUARANTEE that files have been downloaded properly! Most of download managers directly support checksum comparsion and automatic redownloading.
croxxx Indeed, I'm using a download manager and some sort of verification would be awesome!
MD5, SHA1 or others...
I think it could be needed for Galaxy to reliably work on unstable connections anyway.
So please, provide checksums :)
xixas I have to agree. This day and age it's expected that anyone distributing software provide checksums. They are extremely important for both transmission and backup verification, and they only takes a couple of seconds to generate.
@Kamamura > These hashes are to verify file integrity from a known source, not for encryption. MD5 is sufficient, as well as quick and easy to generate/verify. SHA-1 (or higher) is fine if you really want to ensure the file hasn't been tampered with, but there's little security risk here and it takes longer to generate the hash. Still, the tools to generate MD5 and SHA-1 through SHA-512 are preinstalled on most *nix distributions, including Macs, so I'm fine with any of them.
@TheJoe > As Sticky_Soldier mentioned, checksums should always be provided by an authoritative source. Additionally, not only does GOGWiki have largely out of date checksums, but many cross-platform games have only the checksums for their Windows installer. As for updating them, a user account is required and most people aren't going to create an account just to provide up to date hashes.
In the mean time, until such a feature is available at least you can create checksums for your personal backups once you've verified a downloaded file works. Here are a couple of commands to generate in standard md5sum file format.
On Linux:
$ md5sum file_name_here > hash.md5
On Mac (sorry, no built-in formatter):
$ openssl md5 file_name_here | sed -Ee 's/MD5\(([^\)]+)\)= (.*)/\2 \1/' > hash.md5
For SHA-1 use "sha1sum" on Linux or "openssl sha1" on Mac.
Lyeengray The downloader doesn’t reliably verify the download either. I have lost track of how many times the downloader produced several gigabytes of corrupt files and have gone back to browser-based. +1, no, make that +2 for checksum files.
Kamamura I have proposed it, so I naturally vote for it. But please use SHA256, both SHA1 and MD5 are broken already:
www.zdnet.com/blog/security/md5-password-scrambler-no-longer-safe/12317
klatch With the increasing size of GOG downloads (I see single tarballs well over 10 GB or closing 20 GB), this would prove immensely useful, especially to us linux-users who don't have the GOG downloader to our disposal, or even those of us who simply rather not use it, while showing file hashes is a relatively easy undertaking.
shmerl Voted. This is very useful to quickly verify correctness of downloads and shouldn't be hard to add for GOG.
nstgc Yeah, for us Linux folks we're left out in the cold here.
xolotl Yeah, I would certainly love to have this in place.
The fact that the gog.com downloader does checking while downloading doesn't help in cases of disk corruption, checking to see if your on-disk copy is the same as the currently-offered one on the site, and also doesn't help us poor Linux folk who don't have a native gog.com downloader anyway.
EarthlyPangaea The wiki has MD5 hashes, but it would be good to have newer ones like SHA-1 and SHA-2 and have them visible for each file that's available in your library.
posipil I've already had GOG game downloads corrupted by network and disk problems. It would be very helpful to have authoritative checksums to check my downloaded files against. As mentioned, only the GOG packagers can provide authoritative checksums. Ideally the authoritative checksums would come with a digital signature to rule out third party tampering, such as provided with most Linux distro software packages.
Ganni1987 My apologies for the double post (can't edit original one) -
The installers once had a "Check Integrity" button, would love to see it back.
Ganni1987 Was going to suggest this but I see the Wish is already here.
This is one feature I really want to see here, I've made it a habit to check the MD5 of every game I download before backing it up on disc.
I don't instantly install every new game I buy and most of the time I put it on disc for later use. It's a leap of faith when I can't find the MD5 and more than once I ended up having to re download the game and use a new disc.
Make it happen GOG <3
xernos If you can't provide checksums via page or additional text file, please correct Gog installer, adding button "Check Integrity" - sometimes I want only check integrity of my file without installation.
Glamdring7 This seems unnecessary because the GOG.com Downloader automatically checks the integrity of the files as they're being downloaded. If you download your content (games and bonuses) with that tool, you can rest assured it's error-free.
Remus +1
Sticky_Soldier I'm just going to echo the fact that, while the GOGWiki does have hashes, it's not an authoritative source. gog.com is the authoritative source, and it should be the one that states checksums.
you2 The wiki doesn't have the hash of the game I am installing and if public is able to update the hash then it is not a reliable source. I just don't see why gog cannot automate the display of the md5sum/sha1/sha256 of the file and place it next to the download link. I would gladly do it .
you2 
Poulscath It would be nice to have an sfv or md5sum/sha1sum file so downloaded files can be checked en-mass rather than having to do it one at a time.
Warmdrink We have the MD5s, filenames, filesizes and version numbers on the GOGWiki (gogwiki.com). Just search for your game's name and look in the sidebar. If you spot a GOG that doesn't have the sums yet, go to gogwiki.com/wiki/Template:Installerinfo and follow the documentation. It's fairly simple to add the information. Anyway the GOGWiki should suffice before any official update is made.
Thecybermat This would be great, then I could tell whether my files were correct... also I could tell if an updated version had been released without downloading the entire game again.
Thunderstone I agree, especially in case there was a hicup in the download for a larger file. Good to know if the file still came out alright.
45 comments about this wish