How to Verify a File Checksum (SHA-256)

What a checksum tells you

A checksum is a short fingerprint calculated from every byte of a file. If the checksum of your download matches the one published by the developer, the file is identical to theirs. If a single byte differs, because the download broke off or someone altered the file, the checksum is completely different.

In your browser

1. Open the SHA-256 Generator.
2. Choose the downloaded file. Its hashes are calculated on your computer.
3. Paste the published checksum into "Compare with". A match is confirmed straight away.

On Windows

In Command Prompt:

certutil -hashfile file.iso SHA256

Or in PowerShell, which uses SHA-256 by default:

Get-FileHash file.iso

On a Mac

shasum -a 256 file.iso

On Linux

sha256sum file.iso

MD5 and SHA-1

Some sites still publish MD5 or SHA-1 checksums. They are fine for spotting a broken download, but not for detecting deliberate tampering, because matching fakes can be made. Prefer SHA-256 when it is offered.