What is the difference? I found it quite hard to check for integrity using Gpg4win. Checking for hash was easy with Online MD5 & SHA1 Hash Generator For File. Is there any advantage to use Gpg4win? I often see that software developers leave their PGP and signing keys for verification and quite few leave a hash for that purpose. Why?
Yes, there is a lot of difference, although it depends on how the software is produced and published as well.
With a hash you can just check if the file - as downloaded - is correct. For instance if you retrieve a file through a mirror or torrent then you might get a different file than you asked for. Validating the hash on a controlled site by the owner can then assure you that the file is correct. Of course you'd want a different hash than MD5 and SHA-1 is not secure anymore either - SHA-256 is often used instead. However, if an attacker can replace that hash then you're still vulnerable; all it takes is to compromise the site hosting the hash; anybody can calculate a hash over any file after all.
If there is a signature over the file, and you can trust the public key of the developer, then you can just verify the signature. An attacker cannot create a valid signature even if the hosting site of the signature is compromised. In general the key is kept secure with the developer team rather than the persons available for the hosting of the signature.
That's not to say that signatures are a panacea. Establishing the trust of the public key can be tricky and the security of the signing key or signature generation service may not be up to par. For instance, Microsoft authenticode keys have been misused in the past.