<!-- nornir:class: idiot -->
# Checksum-on-upload, explained simply
**The problem.** You send a file. Somewhere on the way a bit flips, or your script
grabbed the wrong file. The server can't tell — it just stores whatever arrived.
**The fix.** You also send a short fingerprint of the file (its *checksum*). The
server makes its own fingerprint of what it received and compares. Same → keep it.
Different → throw it away and say "400, checksum mismatch".
**Analogy.** You mail a parcel and also text the recipient a photo of what's inside.
They open the box and compare. If the box was tampered with or the wrong thing was
packed, they refuse it instead of shelving a broken parcel.
**How you send the fingerprint.** One extra header on your upload:
```
X-Checksum-Sha256: <the sha256 of your file>
```
Get that number with `sha256sum yourfile`.
**Do I have to?** No. If you don't send the header, uploads work exactly like
before. It's a seatbelt you can choose to click in.
**Why not sha1 or md5?** Those old fingerprints are easy to fake, so Holger ignores
them. Use `sha256` (or `sha512`).