How to check a download with SHA-256 checksums

When a software maker publishes a file, it can also publish a short fingerprint of that file, called a checksum or hash. If the file you have produces the same fingerprint, it is bit-for-bit identical to the one the maker published. If even one byte differs, the fingerprint changes completely. Checking it takes a minute and works on every operating system.

What a checksum is

A hash function turns any amount of data into a fixed-length string. SHA-256, the most common one today, produces 64 hexadecimal characters. Older pages sometimes list MD5 or SHA-1 values; these are fine for catching accidental corruption, but they are no longer considered safe against deliberate tampering, so prefer SHA-256 when it is offered.

On Windows

Open Command Prompt or PowerShell in the folder that holds the file and run:

certutil -hashfile filename.zip SHA256

In PowerShell you can also use Get-FileHash filename.zip, which uses SHA-256 by default.

On macOS

Open Terminal and run:

shasum -a 256 filename.dmg

On Linux

sha256sum filename.tar.gz

If the maker provides a checksum file, sha256sum -c followed by that file's name checks everything listed in it at once.

Comparing the result

Compare your result with the published value character by character, or paste both into a text editor and search for one in the other. Upper or lower case does not matter. If they match, the file is the one the publisher made available. If they do not, delete the file and get it again from the official source.

What a checksum does not prove

• It proves the file matches the published value, not that the publisher is trustworthy.
• If an attacker controls the page that lists the checksum, they can change both. A digital signature from the maker is stronger.
• It says nothing about whether the software works with your system.

A habit worth keeping

Checking hashes is routine for system images and security tools, and a good habit for anything that will run with administrator rights. Casino software testers rely on the same idea: approved game files are recorded by their hashes, so anyone can confirm the version running is the one that was tested. Our piece on RNG certificates and test reports explains how that works.