Download pages for operating systems, password managers and developer tools often list a long string labeled "SHA-256" next to each file. That's a checksum: a fingerprint of the exact bytes the publisher released. Computing the same fingerprint for the file you downloaded and comparing the two tells you whether you got exactly that file.
Here's how to do it on Windows, macOS and Linux, how to compare the result without squinting at 64 characters, and what a match does and doesn't prove.
What a SHA-256 checksum is
SHA-256 is a cryptographic hash function. It reads a file of any size and produces 256 bits, usually written as 64 hexadecimal characters. Change a single byte of the file and the result changes completely. For the three-byte file containing abc, every correct SHA-256 tool gives:
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015adChange the content to abd and the hash starts with b10bd3130c1c0c13552e instead, with no visible relationship to the first one. That's what makes hashes useful for checking downloads: you can't get a "close" match by accident.
For more on how hashes differ from encryption and encoding, see Hashing vs Encryption vs Encoding. And for why MD5 and SHA-1 checksums are weaker than SHA-256, see MD5 vs SHA-256 vs bcrypt.
On Windows
PowerShell: Get-FileHash
Open PowerShell in the folder with the file (in File Explorer, right-click inside the folder and choose "Open in Terminal") and run:
Get-FileHash .\installer.exeMicrosoft's Get-FileHash documentation notes that "by default, the Get-FileHash cmdlet uses the SHA256 algorithm," so you don't need to name it. The output shows the algorithm, the hash and the path:
Algorithm Hash Path
--------- ---- ----
SHA256 BA7816BF8F01CFEA414140DE5DAE2223B00361A396177A9CB410FF61F20015AD C:\Users\you\Downloads\abc.txtThe hash is in uppercase. Hex digits are the same in either case, so BA78… and ba78… are a match.
To let PowerShell do the comparison, paste the published value into a variable:
(Get-FileHash .\installer.exe).Hash -eq 'paste-the-published-hash-here'It prints True or False. The -eq comparison ignores case for strings, so a lowercase published hash works.
Command Prompt: certutil
The built-in certutil command also works, from Command Prompt or PowerShell:
certutil -hashfile installer.exe SHA256Its syntax is certutil [options] -hashfile InFile [HashAlgorithm], as listed in Microsoft's certutil reference. Always include SHA256 at the end; without it, certutil uses SHA-1.
On macOS
Open Terminal, type shasum -a 256 (with a space at the end), drag the file from Finder into the Terminal window to fill in its path, and press Return:
shasum -a 256 ~/Downloads/abc.txt
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad /Users/you/Downloads/abc.txtThe -a 256 part matters. Plain shasum without it computes SHA-1, a different and shorter hash.
On Linux
Use sha256sum, part of GNU coreutils and installed on nearly every distribution:
sha256sum abc.txt
ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad abc.txtChecking against a checksum file
Many projects publish a file, often called SHA256SUMS, with one line per download in exactly that format: the hash, two spaces, the file name. Put it in the same folder as your download and let sha256sum do the comparing:
sha256sum -c SHA256SUMS
abc.txt: OKIf the file doesn't match, you'll see:
abc.txt: FAILED
sha256sum: WARNING: 1 computed checksum did NOT matchWhen the checksum file lists many downloads and you only have one, add --ignore-missing so it doesn't complain about the others. On macOS, shasum -a 256 -c SHA256SUMS does the same job.
Without the command line
If you'd rather not use a terminal, the SHA Generator can hash a file in your browser. Switch to file mode and choose the file. It's read on your device and never uploaded; the limit is 500 MB. The tool shows SHA-1, SHA-256, SHA-384 and SHA-512 at once.
Below the results, paste the published checksum into "Compare with an expected hash." You can paste just the hash, an uppercase version, or a whole line copied from a checksum file, file name included. It tells you which algorithm matched, or that nothing did:
Match: it is the SHA-256 hash.No match. The data is different, or the hash uses another algorithm.
The MD5 Generator works the same way for older downloads that only publish MD5 values.
Compare the whole hash, not the first few characters
It's tempting to check the first and last four characters and call it a match. Don't, at least for anything security-sensitive. The point of a 64-character hash is that every character counts. Let the computer compare: sha256sum -c, PowerShell's -eq, or the compare box in the SHA Generator. Copying and pasting the published value also rules out typing mistakes.
Making your own checksums
Checksums aren't only for downloads. They're a quick way to confirm that a backup, a USB copy or a file sent to a colleague arrived intact. On Linux or macOS, create a checksum file for a folder of archives, then check it on the other end:
sha256sum *.zip > SHA256SUMS # on macOS: shasum -a 256 *.zip > SHA256SUMS
sha256sum -c SHA256SUMS # on macOS: shasum -a 256 -c SHA256SUMSIn PowerShell, Get-FileHash *.zip | Format-Table -AutoSize lists every file's hash in one table. Send the checksum file separately from the files themselves (by a different channel, if it matters), so a problem with one doesn't silently affect the other.
What a matching checksum proves
A match proves that the file you have is byte-for-byte identical to the file the hash was made from. That rules out:
- A download that was cut off or corrupted in transit.
- A file altered on a mirror or download server, as long as the checksum came from somewhere the attacker couldn't change.
It doesn't prove the file is safe. If an attacker controls the download page, they can replace the file and the checksum shown next to it, and the two will match perfectly. A checksum is only as trustworthy as the place you got it from.
Signatures close that gap
That's why many projects also sign their checksum file. Ubuntu's tutorial on how to verify your Ubuntu download is a good example. You download SHA256SUMS and SHA256SUMS.gpg next to the image, check the signature with GnuPG, then check the image against the sums:
gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS
sha256sum -c SHA256SUMS 2>&1 | grep OKA "Good signature" means the checksum file was signed by the key holder. As Ubuntu puts it, "if the signature matches, you know it is authentic no matter where/how it was downloaded!" Windows and macOS apps often carry a code signature instead, which the operating system checks when you open them.
If the hashes don't match
- Check that you're comparing the same algorithm. A 40-character value is SHA-1, 32 is MD5, 64 is SHA-256, 128 is SHA-512.
- Check that it's the same file. Download pages list a separate hash for each version, platform and architecture.
- Download it again, preferably from the official site rather than a mirror.
- If it still doesn't match, don't run it. Delete the file and report it to the publisher.
FAQ
Does uppercase vs lowercase matter in a hash?
No. Hex digits A–F mean the same in either case. PowerShell shows uppercase; most other tools show lowercase.
Is MD5 or SHA-1 good enough for checking downloads?
For catching accidental corruption, yes. Against someone deliberately tampering with a file, no: both have known collision attacks, and Microsoft's documentation says MD5 and SHA1 "are no longer considered secure." Prefer SHA-256 when it's offered.
Can two different files have the same SHA-256 hash?
In theory, since there are more possible files than hashes. In practice, no one has ever found two, and finding one deliberately is considered infeasible with current computers.
Why is my hash different every time I download?
It shouldn't be for the same file. If it changes, the server is sending different files (for example, a download page that generates the file on request) or the download is being corrupted. Compare file sizes first.
