Hashes don't match dowloaded file

[Klosterfuchs]

Please follow the guide below

• You will be asked some questions and requested to provide some information, please read them carefully and answer honestly
• Put an x into all the boxes [ ] relevant to your issue (like that [x])
• Use Preview tab to see how your issue will actually look like

---

Make sure you are using the latest version: run youtube-dl --version and ensure your version is 2016.07.11. If it's not read this FAQ entry and update. Issues with outdated version will be rejected.

• I've verified and I assure that I'm running youtube-dl 2016.07.11

Before submitting an issue make sure you have:

• At least skimmed through README and most notably FAQ and BUGS sections
• Searched the bugtracker for similar issues including closed ones

What is the purpose of your issue?

• Bug report (encountered problems with youtube-dl)
• Site support request (request for adding support for a new site)
• Feature request (request for a new functionality)
• Question
• Other

---

The following sections concretize particular purposed issues, you can erase any section (the contents between triple ---) not applicable to your issue

---

If the purpose of this issue is a bug report, site support request or you are not completely sure provide the full verbose output as follows:

Add -v flag to your command line you run youtube-dl with, copy the whole output and insert it here. It should look similar to one below (replace it with your log inserted between triple ```):

$ youtube-dl -v <your command line>
[debug] System config: []
[debug] User config: []
[debug] Command-line args: [u'-v', u'http://www.youtube.com/watch?v=BaW_jenozKcj']
[debug] Encodings: locale cp1251, fs mbcs, out cp866, pref cp1251
[debug] youtube-dl version 2016.07.11
[debug] Python version 2.7.11 - Windows-2003Server-5.2.3790-SP2
[debug] exe versions: ffmpeg N-75573-g1d0487f, ffprobe N-75573-g1d0487f, rtmpdump 2.4
[debug] Proxy map: {}
...
<end of log>

---

If the purpose of this issue is a site support request please provide all kinds of example URLs support for which should be included (replace following example URLs by yours):

• Single video: https://www.youtube.com/watch?v=BaW_jenozKc
• Single video: https://youtu.be/BaW_jenozKc
• Playlist: https://www.youtube.com/playlist?list=PL4lCao7KL_QFVb7Iudeipvc2BCavECqzc

---

Description of your issue, suggested solution and other information

Explanation of your issue in arbitrary form goes here. Please make sure the description is worded well enough to be understood. Provide as much context and examples as possible.
If work on your issue required an account credentials please provide them or explain how one can obtain them.

[Klosterfuchs]

I downloaded the Windows Exe from here https://rg3.github.io/youtube-dl/download.html and it is the latest release.
I used fciv.exe to check the integrity of the file, and neither the md5 or the sha1 that outputted matched those on the site.
I'm unsure what to do now. I don't want to run it under these circumstances, and to be honest it's the first time I've had a checksum come back that didn't match what was expected.

[Klosterfuchs]

Sorry, I joined just to get feedback and am not used to the site. Didn't mean to close the issue.

[phihag]

Can you post the hashes you do get, and the ones that are included in the MD5 files? Works fine for me:

$ wget -q https://yt-dl.org/downloads/2016.07.11/{youtube-dl,youtube-dl.exe,MD5SUMS,SHA1SUMS}
$ md5sum youtube-dl youtube-dl.exe 
d76d7817af3fa4a0f42406df13f041c0  youtube-dl
ce735ef4773432e8cdf3a90b51472373  youtube-dl.exe
$ cat MD5SUMS 
d76d7817af3fa4a0f42406df13f041c0  youtube-dl
ce735ef4773432e8cdf3a90b51472373  youtube-dl.exe
2175d314e9a2715bf724b8c683ee536f  youtube-dl-2016.07.11.tar.gz
$ sha1sum youtube-dl youtube-dl.exe 
11fad82b2911f1d6cf7362e473e570d750932e91  youtube-dl
e2190c340c33a1fff589ffa31d916b5b0a1077cf  youtube-dl.exe
$ cat SHA1SUMS 
11fad82b2911f1d6cf7362e473e570d750932e91  youtube-dl
e2190c340c33a1fff589ffa31d916b5b0a1077cf  youtube-dl.exe
56f7dcb44218ed94a464436cab9db274a8665424  youtube-dl-2016.07.11.tar.gz

If those hashes do not match yours, would you mind uploading the file you got somewhere? Or did you maybe confuse the hashes for our main distribution file youtube-dl and the windows exe file?

[Klosterfuchs]

Okay, I'm a little confused. The only hashes I saw on the download page are these:

MD5: d76d7817af3fa4a0f42406df13f041c0
SHA1: 11fad82b2911f1d6cf7362e473e570d750932e91
SHA256: 69a01054ef78f9b738ac2beef4d1ae92ec89edcc42c08aee9836c2f558e00308

But I see the two I got in your reply.
MD5: ce735ef4773432e8cdf3a90b51472373 SHA1: e2190c340c33a1fff589ffa31d916b5b0a1077cf
This is obviously my misunderstanding, and the .exe is fine.

Those other hashes on the site are for youtube-dl, and not youtube-dl.exe. Could you explain why the hashes for the .exe aren't put on the page? Obviously I'm just getting the hang of this :)

[phihag]

I have updated the download site to clarify:

• Hashes for .exe are already put on the page - that's the long numbers after sig. I added the text SHA256 before that to clarify.
• These days, MD5 can only be used to ensure that the file has not been modified by accident (see https://en.wikipedia.org/wiki/MD5#Security for an entry into more details). Therefore, I have removed MD5 checksums. If you still want to check MD5, download the MD5SUMS file.
• SHA1 is not yet at the level of MD5 (where everyone can generate a collision for a couple bucks at Amazon EC2), but will likely be in the near future. Therefore, I have dropped the SHA1 sum as well. If you still want to check SHA1, download the SHA1SUMS file.

SHA2-256 checksums are the ones that offer up-to-date security. Of course, if you don't want to trust the website, PGP signatures are even better to check. We may even considering adding SHA3 there, but SHA2 is still strong for the foreseeable future.

[Klosterfuchs]

Thanks for clearing that up. I went looking and I found an updated Powershell version of fciv that handles SHA2.
I'll have to check out PGP for the future.