How to verify a file checksum
Download pages publish a SHA-256 or MD5 checksum so you can confirm the file arrived intact and unaltered. Here is how to check one on any computer.
Software download pages, Linux distributions and firmware updates often list a long string of letters and numbers next to the file, labelled SHA-256 or MD5. That is a checksum and it exists so you can confirm that the file on your disk is exactly the file the publisher released.
What a checksum is
A hash function reads every byte of a file and produces a short fixed-length value. Change a single byte, whether through a corrupted download or deliberate tampering and the value changes completely. So if the value you calculate matches the published one, the files are identical.
Checking one in the browser
File hash calculates SHA-256, SHA-1, SHA-384, SHA-512 and MD5 on your device. Drop the file, paste the published value into the comparison box and it tells you whether they match, ignoring capitals and spaces. Large files such as disk images are read in pieces, so size isn’t a problem and nothing is uploaded.
Checking one from the command line
Every operating system has a built-in command:
- Windows:
certutil -hashfile file.iso SHA256orGet-FileHash file.isoin PowerShell. - macOS:
shasum -a 256 file.iso - Linux:
sha256sum file.iso
Compare the output with the published value by eye or paste both into a text editor and search for one in the other.
When they don’t match
Download the file again, ideally from the publisher’s own site rather than a mirror. If it still doesn’t match, don’t open it. A zip or installer that fails its checksum may also fail to open for other reasons; unzip checks every file inside an archive against its own stored checksum and the file type checker tells you whether the file is even what its name claims, as covered in renamed a file and now it’ll not open.
Sending files with a checksum
If you send large files to someone, including the SHA-256 value lets them confirm nothing went wrong in transit. It pairs well with packing several files into one archive, described in how to send a folder by email.
Common questions
What does a matching checksum prove?
That your file is byte for byte identical to the one the publisher hashed. A download that was corrupted or tampered with produces a completely different value. It only proves the file matches what the page says, so the checksum should come from the publisher's own site.
Should I use SHA-256 or MD5?
Use whichever the publisher lists, preferring SHA-256 when both are given. MD5 still catches accidental corruption, but it is possible to create two different files with the same MD5, so it can’t prove a file wasn’t deliberately altered.
How do I check a checksum from the command line?
On Windows, run certutil -hashfile followed by the file name and SHA256 or Get-FileHash in PowerShell. On a Mac, shasum -a 256 followed by the file name. On Linux, sha256sum and the file name.
Why do capital letters or spaces not matter?
A checksum is a number written in hexadecimal, where a and A mean the same thing. Pages format them differently, with spaces or in capitals. The comparison ignores both.