DEV Community

pulkitgovrani
pulkitgovrani Subscriber

Posted on Originally published at ilovekit.app

How to Verify a File Checksum (SHA-256) on Windows, macOS, and Linux

#security #webdev #programming #tutorial

Software downloads often list a checksum, a short string computed from the file's contents. If you compute the same checksum on your copy and it matches, the file is intact. If it doesn't, the download is corrupt or the file was changed.

What a checksum proves (and doesn't)

  • A match shows your file is identical to the one the checksum was computed from.
  • It protects against corruption and accidental changes.
  • It only protects against tampering if the checksum itself came from a trustworthy source, ideally a different channel than the file, such as the vendor's HTTPS page or a signed release.
  • If an attacker can replace both the file and the checksum on the same site, a match proves nothing.

Compute a SHA-256 hash 

# macOS
shasum -a 256 file.iso

# Linux
sha256sum file.iso

# Windows (Command Prompt)
certutil -hashfile file.iso SHA256

# Windows (PowerShell)
Get-FileHash file.iso -Algorithm SHA256
Enter fullscreen mode Exit fullscreen mode

Compare the result

  1. Copy the checksum published by the vendor.
  2. Run the command above on your downloaded file.
  3. Compare the two values character by character; hex case doesn't matter, but every digit does.
  4. Or paste both into a verifier tool that reports match or mismatch for you.

If it doesn't match

  • Re-download the file; interrupted or flaky downloads are the usual cause.
  • Make sure you compared the right algorithm (SHA-256 vs SHA-1 vs MD5) and the right file version.
  • Check you didn't copy extra whitespace.
  • If it still fails, don't run the file; get it from an official source again.

Hash locally

Hashing a large file in your browser doesn't upload it anywhere, so you can check installers and private documents without exposing them.

Frequently asked questions

What is a file checksum?

A short fingerprint computed from a file's contents. Any change to the file produces a different checksum.

Which algorithm should I use to verify downloads?

SHA-256 is the common standard. Use whichever algorithm the publisher lists.

Does a matching checksum mean the file is safe?

It means it matches the published one. It is only as trustworthy as the source of the checksum.

How do I check a SHA-256 hash on Windows?

Run Get-FileHash file -Algorithm SHA256 in PowerShell, or certutil -hashfile file SHA256 in Command Prompt.

Try it: Checksum Verifier — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

Top comments (0)