crc32()

The PHP crc32() function calculates the CRC-32 (Cyclic Redundancy Check) of a string and returns it as a 32-bit integer. CRC-32 is a fast, lightweight checksum: it turns any string into a short fingerprint, so you can later detect whether the data changed (accidental corruption during a download, a disk error, a flipped bit). It is a detection tool, not a security tool — see the notes below.

This page covers the syntax, the signed/unsigned gotcha that trips up most people, a runnable example, a realistic integrity check, and when to reach for a real hash instead.

Syntax

crc32(string $string): int

It takes a single parameter — the $string to analyze — and returns the CRC-32 checksum as an integer.

The signed vs. unsigned gotcha

CRC-32 is conceptually a 32-bit unsigned value (0 to 4,294,967,295). On 64-bit platforms PHP returns it as a normal positive integer. On 32-bit platforms, values above 2,147,483,647 wrap around and come back negative. To get the same unsigned value everywhere, format it with %u:

$unsigned = sprintf('%u', crc32($str)); // always positive, as a string

Basic example

We pass the string to crc32() and wrap it in sprintf('%u', ...) so the result is consistent on every platform. The output of this code is:

3964322768

Many tools (and the cksum/zip world) display CRC values in hexadecimal. To match that, format with %08X for a zero-padded 8-digit hex string:

<?php
echo sprintf('%08X', crc32("Hello, World!")); // EC4AC3D0
?>

Verifying data integrity

The real use of CRC-32 is to detect change. You compute and store a checksum once, then recompute it later and compare — if the two differ, the data was altered. Here is a self-contained example that stores a checksum, then validates a copy against it:

<?php
$data = "important payload";

// Compute and store the checksum once (e.g. in a manifest or database).
$expected_crc = crc32($data);

// Later, recompute it for the data you received and compare.
$received = "important payload";
$actual_crc = crc32($received);

if ($actual_crc === $expected_crc) {
    echo "OK: data is intact.";
} else {
    echo "FAIL: data has changed.";
}
?>

This prints OK: data is intact.. To check a real file, swap the string for crc32(file_get_contents($filename)). Use the strict === comparison so PHP compares both the value and the type — and if your expected checksum arrives as a hex string from an external source, convert it first with (int) hexdec($expected_crc).

Important notes

• Not cryptographically secure. CRC-32 is trivial to forge — an attacker can craft different data with the same checksum. Use it only for accidental-error detection, never for passwords, signatures, or tamper protection.
• Collisions happen. With only ~4.3 billion possible values, two different strings can share a checksum. That is fine for catching corruption but not for uniquely identifying data.
• For security or content addressing, use a real hash. Reach for md5(), sha1(), or the modern hash() (e.g. SHA-256) — and md5_file() / sha1_file() for files.

Summary

crc32() is a fast way to fingerprint a string for accidental-error detection — verifying downloads, spotting corrupted records, or sanity-checking data in transit. Remember to normalize the result with sprintf('%u', ...) for cross-platform consistency, and choose a cryptographic hash whenever security matters.

Practice