How does a simple checksum work, and what is its fundamental limitation?

A checksum is a value derived from data to detect changes — but a simple one can miss errors that cancel out.

* A worked digit-sum example: checksums catch single-digit corruption but miss offsetting changes that leave the total unchanged. *

Example — use the digit sum (Quersumme) as a checksum:

• Number 34567 → 3+4+5+6+7 = 25
• Change one digit → the sum changes → error detected ✓
• Change two digits that offset each other → the sum can stay the same → error missed ✗

Real-world simple checksums work the same way: ISBN, credit-card numbers (Luhn), CRC-16/32. The ISBN-13 check digit, for instance, weights digits ×1,×3,×1,×3… sums them, and picks the digit that rounds up to the next multiple of 10.

Why it matters: simple checksums catch accidental single-point errors but give no protection against a deliberate attacker, who can craft changes that preserve the checksum. For that you need cryptographic hashes or signatures.

Tip: Checksum = error detection, not security. If an attacker can recompute it, it protects nothing.

Go deeper:

• Checksum (Wikipedia) — defines checksum algorithms and their blind spots — reordered or offsetting errors go undetected.
• Error detection and correction (Wikipedia) — the broader picture: parity, checksums, CRC and cryptographic hashes, and what each can and cannot catch.