How to Verify a File Download With a SHA-256 Checksum (Windows, macOS, Linux)

By Talk & Tool4 min read

Software downloads, disk images and firmware updates often sit beside a long string labelled SHA-256. Comparing that string against the file you received takes under a minute and catches corrupted downloads outright. It can also catch tampering — but only under conditions that are worth understanding before you rely on it.

What a checksum proves

A SHA-256 checksum is a hash of the file's exact bytes. If a single bit of the file differs, the hash is completely different. So a matching hash tells you the file you have is byte-for-byte identical to the file the publisher hashed.

It does not tell you that the file is safe, or even that the publisher is who you think it is. It tells you the two files match. Everything else depends on where the published hash came from, which is covered below.

Calculate the hash on your machine

Every major operating system ships a tool for this. No download is needed.

Windows (Command Prompt or PowerShell):

certutil -hashfile "C:\Users\you\Downloads\installer.exe" SHA256

PowerShell also has a native cmdlet:

Get-FileHash .\installer.exe -Algorithm SHA256

macOS (Terminal):

shasum -a 256 ~/Downloads/installer.dmg

Linux:

sha256sum ~/Downloads/image.iso

Each prints a 64-character hexadecimal string. Upper- or lower-case letters do not matter; hexadecimal is case-insensitive.

Compare the result properly

Do not compare by glancing at the first and last few characters. Attackers can, with effort, produce hashes that look similar at the ends, and people simply misread long strings.

On Linux and macOS, let the tool do the comparison. If the publisher provides a SHA256SUMS file, run sha256sum -c SHA256SUMS in the same folder and it reports OK or FAILED for each file. You can also compare against a single hash in one line:

echo "PUBLISHED_HASH  image.iso" | sha256sum -c

In PowerShell, compare the strings directly:

(Get-FileHash .\installer.exe).Hash -eq "PUBLISHED_HASH"

If you are checking a hash someone pasted into a chat or ticket, the diff checker highlights the exact character where two long strings diverge, and find and replace strips stray spaces or line breaks that were copied along with it.

When the hashes do not match

Do not run the file. Then work through the likely causes in order:

  1. Wrong algorithm. A SHA-1 or SHA-512 hash will never match a SHA-256 result. Check the label, and the length: SHA-1 is 40 hex characters, SHA-256 is 64, SHA-512 is 128.
  2. Wrong file or version. The published hash may be for a different architecture, edition or release.
  3. Incomplete download. Compare the file size with the one listed on the download page, then download again.
  4. Modified in transit. Some antivirus and corporate proxies alter or rewrap downloads. Try from another network.

If a fresh download from the official source still fails, report it to the publisher and do not use the file.

Where the published hash came from matters

If an attacker can replace the file on a download server, they can often replace the hash on the same page too. In that case both match and the check proves nothing. A checksum therefore protects against tampering only when the hash reaches you through a different, trustworthy path:

  • The hash is published on the project's main site while the file comes from a mirror.
  • The hash is included in release notes on a separately hosted source such as the project's repository.
  • The checksum file is itself signed with the publisher's GPG or Sigstore key, and you verify that signature.

Signatures are the stronger guarantee because they tie the file to a key only the publisher holds. Where a project offers them, verify the signature and treat the checksum as a quick corruption check on top.

Hashing text instead of files

Hashes are also used for text — API request signatures, cache keys and content fingerprints. Here, invisible differences cause most mismatches: a trailing newline, Windows line endings, or a different Unicode normalisation of an accented character. The hash generator computes SHA-256 of text in the browser, which makes it easy to test whether a trailing newline is the reason two systems disagree — add or remove it and watch the digest change entirely.

Why not MD5 or SHA-1?

Both still detect accidental corruption, and older projects publish them. Neither is safe against deliberate tampering, because collisions — two different files with the same hash — can be produced. Prefer SHA-256 whenever it is offered. The difference between integrity checks, encryption and encoding is covered in our guide to encoding vs encryption vs hashing.

Related reading