What Is a SHA-1 Hash?
A SHA-1 hash is a 40-character fingerprint generated from the exact binary content of a file. Change even a single byte in a JAR and the hash changes completely. Two files with the same name but different code will have different hashes. A legitimate Sodium JAR and a Wurst JAR renamed to look like Sodium will never share a hash — there is no way for a cheater to produce the same hash as a legitimate file.
How Audit AC Uses Modrinth's Database
Modrinth, the largest open-source Minecraft mod repository, exposes a public API that returns hash information for every version of every mod they host. Audit AC computes the SHA-1 hash of every .jar in the player's mods folder, queries the Modrinth API and a supplementary Megabase cross-reference, then returns one of five classifications: Verified, Tampered, Unknown, Cheat, or Disallowed.
Reading a Tampered Mod Report
When tampering is detected, the dashboard shows the expected file size from Modrinth vs the actual size found on disk, the difference in KB, a link to the legitimate mod page for direct comparison, and the ALERT reason. A 50+ KB difference is almost certainly an injected payload. Marginal differences of 1–3 KB may indicate a cracked or repackaged version.
ALERT: File size mismatch vs official Modrinth release.
Expected: 892 KB
Found: 944 KB
DIFFERENCE: 52 KBWhat to Do When Tampering Is Detected
Do not accept the 'I got it from a friend' excuse — legitimate mods from official sources always hash-verify correctly. Check the download source field: Audit AC reports where the mod was sourced from when that metadata is available, and third-party sites are a red flag. Use the Modrinth link in the dashboard to compare version, author, and changelog directly.
Parallelized for Speed
Because a typical player might have 50+ mods installed, Audit AC runs all hash lookups concurrently using multi-threaded workers. The entire scan — including Modrinth API resolution for 50+ mods — completes in seconds, not minutes. Speed matters when a player is waiting on a screenshare call.