DEV Community

yuus_company
yuus_company

Posted on

How to verify a file checksum on macOS, Linux, and Windows (and why you should)

#security #beginners #tutorial #devops

You download an installer, a firmware image, or a database dump. Next to the download link the site lists something like:

SHA-256: 3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b
Enter fullscreen mode Exit fullscreen mode

Most people ignore it. Here's why you shouldn't, and the fastest way to check it on every OS.

What a checksum actually proves

A cryptographic hash (SHA-256, MD5, ...) is a fingerprint of a file's exact bytes. If even one bit changes — a corrupted download, a truncated transfer, or a tampered binary — the hash changes completely.

Comparing your local hash against the published one proves two things:

  1. Integrity — the file wasn't corrupted in transit.
  2. Authenticity (partially) — the file is the one the publisher hashed. (Full authenticity needs a signature, but a checksum from a trusted HTTPS page is a solid baseline.)

The commands, per OS

macOS / Linux:

shasum -a 256 file.zip     # works on both
sha256sum file.zip         # Linux (coreutils)
md5 file.zip               # macOS MD5
md5sum file.zip            # Linux MD5
Enter fullscreen mode Exit fullscreen mode

Windows (cmd):

certutil -hashfile file.zip SHA256
Enter fullscreen mode Exit fullscreen mode

Windows (PowerShell):

Get-FileHash file.zip -Algorithm SHA256
Enter fullscreen mode Exit fullscreen mode

Then eyeball-compare the output against the published value — or pipe it:

echo "3a7bd3e2...  file.zip" | shasum -a 256 -c
Enter fullscreen mode Exit fullscreen mode

Which algorithm should you trust?

Algorithm Verdict
MD5 Fine for duplicate detection and cache keys. Not for security — collisions are practical.
SHA-1 Legacy compatibility only.
SHA-256 The default. Use this.
SHA-512 Also fine; sometimes faster than SHA-256 on 64-bit CPUs.

The rule of thumb: if an attacker could benefit from forging a matching file, MD5 and SHA-1 are out.

When you don't have a terminal handy

Sometimes you're on a locked-down machine, or you just want to check a file quickly without remembering flags. Browser-based tools can hash files locally with the Web Crypto API — the file never leaves your machine.

I use this file hash tool: drag the file in, paste the expected checksum, and it auto-detects which algorithm matches. It streams large files in 8MB chunks, so multi-GB files work without freezing the tab.

Whatever tool you use, verify that it computes hashes client-side — uploading a sensitive file to hash it defeats the purpose.

TL;DR

  • Always check the checksum for installers, firmware, and backups.
  • shasum -a 256 / certutil -hashfile ... SHA256 / Get-FileHash cover every OS.
  • Prefer SHA-256. Keep MD5 for non-adversarial jobs.
  • Browser tools work too, as long as hashing happens locally.

Top comments (0)