How to Verify a File Checksum (SHA-256)

What a checksum tells you

A checksum is a short fingerprint calculated from every byte of a file. If the checksum of your download matches the one published by the developer, the file is identical to theirs. If a single byte differs, because the download broke off or someone altered the file, the checksum is completely different.

In your browser

1. Open the Hash Generator.
2. Choose the downloaded file. Its hashes are calculated on your computer.
3. Paste the published checksum into "Compare with". A match is confirmed straight away.

On Windows

In Command Prompt:

certutil -hashfile file.iso SHA256

Or in PowerShell, which uses SHA-256 by default:

Get-FileHash file.iso

On a Mac

shasum -a 256 file.iso

On Linux

sha256sum file.iso

MD5 and SHA-1

Some sites still publish MD5 or SHA-1 checksums. They are fine for spotting a broken download, but not for detecting deliberate tampering, because matching fakes can be made. Prefer SHA-256 when it is offered.

A worked example

Make a text file that contains only the word hello, with no line break after it. Its SHA-256 checksum is

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824

Press Enter after the word and save again. The file is one byte longer, and the checksum becomes

5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03

Nothing about the second hash resembles the first. That is the point of a checksum: any change, however small, gives a completely different result.

Common problems

• The hashes almost match. There is no "almost". Either every character matches or the files differ. Compare the whole string, not just the first and last few characters. Uppercase and lowercase letters count as the same.
• You checked against the wrong file. Download pages often list several checksums, for the installer, the disk image, 32-bit and 64-bit. Match the file name as well.
• The checksum sits next to the download. It proves the file was not damaged on the way. If the server itself were hacked, both could have been replaced. Projects that sign their checksum files (.asc or .sig) let you check the signature with GPG to rule that out.