How to Verify a File Download with a SHA-256 Checksum
Software sites often list a long string of letters and numbers next to the download button. That string lets you prove the file you got is the file they published. Here is how to check it, and what a match really tells you.
What a checksum is
A cryptographic hash function such as SHA-256 reads a file of any size and outputs a fixed-length fingerprint: 64 hexadecimal characters for SHA-256. Two properties make it useful. Change a single bit of the file and the fingerprint changes completely. And no one can feasibly construct a different file that produces the same fingerprint.
A publisher computes the hash of the genuine file and posts it. After downloading, you compute the hash yourself. If the two strings match, your copy is byte-for-byte identical to theirs.
What a match proves — and doesn't
- It proves the download wasn't corrupted in transit and, if the checksum came from a trustworthy source, that the file wasn't swapped for a different one.
- It doesn't prove the file is safe. If an attacker compromised the website and changed both the file and the checksum listed beside it, they would still match. That's why serious projects also sign releases with GPG or publish the checksum on a separate channel.
The strongest habit is to get the checksum from a different place than the file, for example the project's official announcement or repository rather than a mirror.
On Windows
In PowerShell:
Get-FileHash .\installer.exe -Algorithm SHA256
Or in Command Prompt:
certutil -hashfile installer.exe SHA256
On macOS and Linux
On macOS:
shasum -a 256 installer.dmg
On Linux:
sha256sum installer.iso
Many projects publish a SHA256SUMS file. With it you can check in one go: sha256sum -c SHA256SUMS.
In your browser
If you'd rather not open a terminal, drop the file into the hash tool, paste the publisher's checksum into the verify box, and it highlights the matching algorithm row. Hashing uses the browser's built-in Web Crypto API, so the file is read on your device and never uploaded — helpful when the file is an ISO or a document you would rather not send anywhere.
Which algorithm?
- SHA-256: the standard for verifying downloads. Use it whenever it is offered.
- SHA-512: same family with longer output. Fine where required.
- SHA-1: broken for security since practical collisions were demonstrated in 2017. Still appears in Git and older listings.
- MD5: quick and fine to catch accidental corruption, but attackers can forge collisions. Not for proving authenticity.
If the checksums don't match
- Check you're comparing the right algorithm and file. Comparing an MD5 to a SHA-256 will never match.
- Ignore case and spaces. Hex is case-insensitive; a stray space or newline in the pasted value is a common false alarm.
- Download again, ideally from a different network or mirror. A single flipped bit from a bad connection is enough to change the hash.
- If it still doesn't match, don't run it. Report it to the publisher.
Frequently asked questions
Is a checksum the same as a digital signature?
No. A checksum shows two files are identical; a signature also shows who published the file, using cryptographic keys.
Why is my hash different from the website's?
Usually the wrong algorithm, the wrong file version, a corrupted download, or a copy-paste error. Retry the download first.
Can two different files have the same SHA-256?
It's theoretically possible but no such collision has ever been found, and none is feasible with current technology.
Does the tool have a size limit?
The file is loaded into memory, so very large files of several gigabytes may fail. For those, use the command-line tools above.