How-to Guides Security

How to Verify a File Checksum

Confirm a download is complete and untampered by comparing its SHA-256 checksum with the published value, in the browser or on the command line.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Steps

  1. Find the published checksum

    Look on the official download page or in a file such as SHA256SUMS next to the download. Note the algorithm: 64 hexadecimal characters is SHA-256, 128 is SHA-512, 40 is SHA-1 and 32 is MD5.

  2. Open the checksum calculator and pick the algorithm

    Open the File Checksum Calculator. SHA-256 is ticked by default; tick MD5, SHA-1, SHA-384, SHA-512 or CRC-32 if the publisher used one of those.

  3. Paste the expected value

    Paste the published value into Expected checksum. A bare hash, a sha256sum line (hash filename) or a BSD line (SHA256 (file) = hash) all work, in upper or lower case.

  4. Drop the downloaded file

    Drop the file, or choose it, and wait for the checksum. Files are read in the browser and never uploaded; files up to 1 GB are supported.

  5. Read the verdict

    Match means one of the computed checksums equals the expected value. No match means the file differs: download it again from the official source and do not open or install the copy you have.

  6. Or check from the command line

    On Linux run sha256sum -c SHA256SUMS, on macOS shasum -a 256 file, and in Windows PowerShell Get-FileHash file -Algorithm SHA256, then compare the output with the published value.

What you need

The downloaded file, the checksum the publisher lists for it, and a browser or terminal. To check a short piece of text rather than a file, use the Hash Generator instead. If the publisher offers several algorithms, SHA-256 or SHA-512 is the one to use.

Reading the result

A checksum changes completely when a single byte changes. Take a 14-byte file release-notes.txt containing Hello, world! followed by a newline:

Algorithm Checksum of release-notes.txt
CRC-32 7b55a718
MD5 746308829575e17c3331bbcb00c0898b
SHA-1 09fac8dbfd27bd9b4d23a00eb648aa751789536d
SHA-256 d9014c4624844aa5bac314773d6b689ad467fa4e1d1a50a1b8a99d5a95f72ff5

Change the exclamation mark to a question mark and the SHA-256 becomes 84c8826b6695ba4f02c9b9a31bb13e2f3fe83c4288cee2f09277e54f5b06ba8d. Nothing about the two values looks similar, which is the point: you never need to compare "how close" two checksums are. They match exactly or the file is different.

On the command line, the same check against a SHA256SUMS file looks like this:

$ sha256sum -c SHA256SUMS
release-notes.txt: OK

and after the one-character change:

release-notes.txt: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

In the calculator, pasting an MD5 value while only SHA-256 is ticked gives No match with a hint that the expected value looks like MD5. Tick that algorithm and the comparison runs again.

Common pitfalls

  • Comparing different algorithms. A SHA-1 value will never match a SHA-256 result. Count the characters if the page does not say.
  • Hashing text instead of the file. Typing Hello, world! into a text hasher gives 315f5bdb76d078c43b8ac0064e4a0164612b1fce77c869345bfc94c75894edd3, because the file also contains a newline. Text and files are hashed byte for byte.
  • Checking a modified copy. Transfers that convert line endings, and tools that unpack or recompress archives, change the bytes. Hash the file exactly as downloaded.
  • Getting the checksum from the same place as the file. If a mirror was compromised, its checksum may be too. Prefer the project's own HTTPS site, and a signed checksum file when available.
  • Worrying about letter case. PowerShell prints upper-case hex and sha256sum lower-case. They are the same value, and the calculator ignores case.

Going further

Why a tiny change scrambles the whole value, and why MD5 and SHA-1 are no longer trusted against attackers, is explained in How Hashing Works.

Try these tools

File Checksum Calculator

Calculate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 checksums of one or many files and compare them with a published value.

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text, computed locally with the Web Crypto API.

See also

  • Guide How Hashing Works
    What a hash function does, the avalanche effect shown with real SHA-256 output, which algorithms are still safe, HMAC.
  • Glossary Checksum
    A checksum is a small value calculated from a block of data and used to detect accidental errors when the data is stored or sent.
  • Glossary Hash
    A hash is the fixed-length fingerprint a hash function computes from any input.
  • Glossary Digital signature
    A digital signature is a value computed from a message and a private key that proves who created it and that it has not been changed.

Frequently Asked Questions

It still catches accidental corruption, such as a truncated download. It does not protect against a deliberate attacker, who can craft two different files with the same MD5. Use SHA-256 whenever the publisher offers it.

It means your file is byte-for-byte the file whose checksum was published. If an attacker replaced both the file and the checksum on the same page, they will still match. Get the checksum from a separate trusted place, or check the publisher's signature.

Back to the how-to guides
AdSense Placeholder
Slot: footer_leaderboard