Checksums, plainly

A checksum is a short string calculated from every byte of a file. The same bytes always produce the same string. Flip a single bit and the string changes. Hash the card file and the copy: if the two match, the copy is identical.

The ones you will see

• xxHash. Built for speed. It runs at tens of gigabytes per second, far faster than any drive, so the check never slows the copy. It catches accidental corruption well. It is not cryptographic.
• MD5. The old standard. Slower, and broken for security, but still fine for spotting corruption and widely supported in older pipelines.
• SHA-256. Cryptographic, so it resists deliberate forgery, not just accident. Slower in software, though modern chips speed it up. Use it when a delivery spec or a chain-of-custody asks for it.
• CRC32C and C4. CRC32C is fast and weak, good for quick error detection. C4 is a cryptographic ID used in some cinema pipelines.

Speed for the copy, cryptography for the courtroom.

So which one for an offload

For getting a card off safely, you want a hash that is fast enough to verify every file without slowing you down, and reliable at catching corruption. That is xxHash, which is why OffShoot, ShotPut Pro, Silverstack and YoYotta all default to it. Stow uses it too.

Reach for a cryptographic hash when the job demands proof against tampering: legal hold, insurance, or a deliverable that names SHA or C4. For everyday card-to-drive safety, that strength is not needed, and it costs speed.

What no checksum can do

A matching checksum proves the bytes are identical. It does not prove the file was read off the disk rather than from memory, and it does not make a single copy safe. The hash is one part of a verified offload. Reading the destination back, and keeping two copies, are the others.