The crc32() function computes a 32-bit CRC checksum of a string—a fast fingerprint used to detect accidental data changes. It returns an integer and is ideal for integrity checks, not for passwords or cryptographic hashing.
32-bit data fingerprint.
Pass string to hash.
Integer checksum value.
Use dechex() or sprintf.
Detect data corruption.
Use hash() for security.
In PHP, crc32() generates the cyclic redundancy checksum of a string using the standard 32-bit CRC polynomial. The same input always produces the same checksum, and even a one-character change produces a different value—making it useful for spotting accidental corruption during transmission or storage.
Think of crc32() as a quick “did this data change?” check—like a lightweight fingerprint. For passwords, API tokens, or anything an attacker might tamper with, use hash('sha256', $data) or password_hash() instead.
The crc32() function accepts one string parameter:
int crc32(string $string)$string — the data to checksum. Can be text or binary bytes.Returns the CRC32 checksum as a 32-bit integer. On 64-bit PHP installations the result is always positive. On 32-bit systems, large values may appear as negative integers—use sprintf("%u", $crc) for the unsigned decimal representation.
crc32($data)Integer CRC32 value
sprintf("%u", crc32($d))Always positive decimal
dechex(crc32($d))Lowercase hex (pad to 8)
hash("crc32b", $d)8-char hex string
Run these examples in PHP 7+. Each demonstrates a common pattern beginners encounter with crc32().
Calculate and display a CRC32 checksum.
The simplest usage: pass a string and print the integer checksum.
<?php
$data = "Hello, PHP!";
$crc = crc32($data);
echo "CRC32 of '$data': $crc\n";
?>Every byte in the string contributes to the final 32-bit value. The same string always produces 2195065251 on 64-bit PHP.
Format the checksum for logs, databases, or comparison with external tools that expect hex strings.
<?php
$data = "The quick brown fox jumped over the lazy dog.";
$crc = crc32($data);
echo "Raw int: $crc\n";
echo "Unsigned: " . sprintf("%u", $crc) . "\n";
echo "Hex: " . str_pad(dechex($crc), 8, "0", STR_PAD_LEFT) . "\n";
echo "Via printf: ";
printf("0x%08x\n", $crc);
?>sprintf("%u", $crc) forces unsigned decimal display on 32-bit PHP.dechex() converts to hex; pad to 8 characters for a full 32-bit representation.Integrity checks, hash() comparison, and security guidance.
Store a checksum when saving data, then recompute and compare when reading it back.
<?php
$payload = "user=42&action=save";
$stored = crc32($payload); // saved alongside data
// Later, after transmission or storage...
$received = "user=42&action=save";
$check = crc32($received);
if ($check === $stored) {
echo "Integrity OK — data unchanged.\n";
} else {
echo "Integrity FAIL — data was modified.\n";
}
// One character change breaks the match:
$tampered = "user=42&action=save!";
echo "Tampered match: " . (crc32($tampered) === $stored ? "yes" : "no") . "\n";
?>CRC32 detects accidental corruption quickly. It is not tamper-proof—an attacker who knows the algorithm can craft data with the same checksum.
The hash() function can produce the same CRC32 checksum as an 8-character hex string.
<?php
$data = "Hello, PHP!";
$intCrc = crc32($data);
$hexPad = str_pad(dechex($intCrc), 8, "0", STR_PAD_LEFT);
$hashCrc = hash("crc32b", $data);
echo "crc32() int: $intCrc\n";
echo "dechex padded: $hexPad\n";
echo "hash('crc32b'): $hashCrc\n";
echo "Match: " . ($hexPad === $hashCrc ? "yes\n" : "no\n");
?>hash("crc32b", $data) is portable and returns hex directly—useful when integrating with tools that expect string hashes rather than integers.
Understand why CRC32 is for integrity checks, while SHA-256 is for cryptographic hashing.
<?php
$data = "CodeToFun";
$crc = crc32($data);
$sha = hash("sha256", $data);
echo "CRC32 (int): $crc\n";
echo "CRC32 length: " . strlen((string) $crc) . " digits (32-bit)\n";
echo "SHA-256: $sha\n";
echo "SHA-256 length: " . strlen($sha) . " hex chars (256-bit)\n";
// CRC32 is fast; SHA-256 is slower but cryptographically strong
echo "\nUse CRC32 for: file download checks, cache keys\n";
echo "Use SHA-256 for: passwords, signatures, API tokens\n";
?>CRC32 has only 232 possible values, so collisions are inevitable for large datasets. SHA-256 provides vastly stronger collision resistance for security-sensitive applications.
crc32($key).crc32() WorksYou pass text or binary data. Every byte in the string will be processed.
PHP runs the standard 32-bit CRC algorithm over all bytes, producing a compact checksum value.
The result fits in 32 bits. Format it as unsigned decimal or hex when storing or displaying.
Compare later to verify the string has not changed.
sprintf("%u", crc32($s)) to avoid negative integer display."" produces CRC32 value 0.hash("crc32b", $s) returns the same checksum as hex—often easier for storage and comparison.hash("sha256", $data) or stronger algorithms.The crc32() function provides a fast, simple checksum for detecting accidental data changes. It returns a 32-bit integer that you can format as unsigned decimal or hexadecimal for storage and comparison.
Use it for integrity checks and cache keys; reach for hash() with SHA-256 or stronger when security matters.
sprintf("%u", $crc) for portable unsigned displaystr_pad(dechex($crc), 8, "0", STR_PAD_LEFT)hash("crc32b") when you need a hex string directlycrc32()Use these points whenever you compute checksums in PHP.
Fast data fingerprint.
Purposesprintf / dechex.
DisplayHex string version.
AlternativeDetect corruption.
Use caseUse SHA-256 instead.
SecurityContinue with crypt(), explode(), and the rest of the string function reference.
6 people found this page helpful