Fact · Voice privacy and security
The openai-whisper package checks each model file against a SHA256 checksum and downloads it again when the checksum does not match.
Checked against its source on October 17, 2026
In the source's own words
“exists, but the SHA256 checksum does not match; re-downloading the file”
openai/whisper: whisper/__init__.py (model download and loading code), OpenAI, GitHub (openai/whisper, main branch), 2026, _download function.
Open the original- What it measures
- The expected checksum is taken from the download address of each model. The loader also checks the file again after a download finishes.
- What it does not show
- This protects against a corrupted or swapped file on the download path. It does not check what the model does, and it applies to the Python package, not to every app that bundles a Whisper model.