How to verify a file checksum (SHA-256) — and what it proves
Check that a download is exactly what its publisher released: find the checksum, compare it in your browser or from the command line, and understand its limits.
Published
Tools for this job: File Checksum Verifier · SSL Certificate Checker
Download pages for operating systems, software installers and firmware often list a long string of letters and numbers labelled SHA-256 or MD5. That is a checksum, and comparing it with your downloaded file takes under a minute.
What a checksum is
A cryptographic hash function turns any file — a few kilobytes or many gigabytes — into a short, fixed-length fingerprint. Change a single bit anywhere in the file and the fingerprint changes completely. So if the fingerprint of your copy matches the one the publisher printed, your copy is byte-for-byte identical to theirs.
To see how sensitive it is, here are the SHA-256 fingerprints of two words that differ by a single capital letter:
- hello →
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 - Hello →
185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
Nothing about the second value hints at how close the inputs were. That is what makes a matching checksum convincing.
That catches two different problems:
- Corruption — a download that was cut short or damaged on the way.
- Tampering — a file swapped for a modified one, for example on a compromised mirror site.
Where to find the checksum
Look on the download page, in the release notes, or in a small text file next to the download with a name such as SHA256SUMS. Take it from the publisher's own website, over HTTPS. A checksum copied from the same unofficial mirror as the file proves very little: anyone able to swap the file could swap the checksum too.
Verify a file step by step
- Open the File Checksum Verifier and add the downloaded file.
- Paste the published checksum. The algorithm is recognised from its length, and whole lines copied from a checksum file are accepted.
- Press Calculate checksums.
- Read the verdict: the values either match exactly or they do not.
The file is read from your disk in chunks and hashed in your browser. It is never uploaded, which matters for the kinds of files people check — installers, backups and disk images — and memory use stays flat even for very large files.
Recognising the algorithm
Each algorithm produces a fingerprint of a fixed length, counted in hexadecimal characters, so the length alone tells you which one a published checksum uses:
| Algorithm | Length | Catches |
|---|---|---|
| MD5 | 32 | Accidental corruption only |
| SHA-1 | 40 | Accidental corruption only |
| SHA-256 | 64 | Corruption and tampering |
| SHA-512 | 128 | Corruption and tampering |
MD5 and SHA-1 are broken against deliberate attacks: it is practical to construct two different files with the same MD5 or SHA-1 fingerprint. When a publisher offers SHA-256 or SHA-512, compare that.
From the command line
Every major operating system can calculate a SHA-256 checksum without extra software:
- Windows (PowerShell):
Get-FileHash .\file.iso— SHA-256 is the default. In Command Prompt,certutil -hashfile file.iso SHA256. - macOS:
shasum -a 256 file.iso - Linux:
sha256sum file.iso, orsha256sum -c SHA256SUMSto check every file listed in a checksum file.
Comparing two 64-character strings by eye is error-prone. Check the whole value, not just the first and last few characters — or paste both into the verifier and let it compare.
If the checksums do not match
- Make sure you are comparing the right file and the right version; checksums are listed per file.
- Download the file again, preferably from the publisher's main site.
- If a fresh download from the official source still does not match, do not run or install it. Report it to the publisher.
In practice, nearly every mismatch is an incomplete download or a checksum for a different version. But the point of checking is that you do not have to guess.
What a checksum does not prove
A matching checksum proves your file is identical to the one the checksum describes. It does not prove who made it. If an attacker controls the website, they can publish a modified file and a matching checksum together. Stronger guarantees come from digital signatures:
- Signed checksum files, often published with a .sig or .asc file, can be verified with the publisher's public key.
- Code signing on Windows and macOS shows the verified publisher of an installer; on Windows, look at the Digital Signatures tab in the file's properties.
Downloading over HTTPS from the official site is the first line of defence; if a site's certificate looks wrong, the SSL Certificate Checker shows who issued it and whether browsers trust it.