How to Verify a File Checksum (SHA-256) on Windows, macOS, and Linux

Software downloads often list a checksum, a short string computed from the file's contents. If you compute the same checksum on your copy and it matches, the file is intact. If it doesn't, the download is corrupt or the file was changed.

What a checksum proves (and doesn't)

A match shows your file is identical to the one the checksum was computed from.
It protects against corruption and accidental changes.
It only protects against tampering if the checksum itself came from a trustworthy source, ideally a different channel than the file, such as the vendor's HTTPS page or a signed release.
If an attacker can replace both the file and the checksum on the same site, a match proves nothing.

Compute a SHA-256 hash

# macOS
shasum -a 256 file.iso

# Linux
sha256sum file.iso

# Windows (Command Prompt)
certutil -hashfile file.iso SHA256

# Windows (PowerShell)
Get-FileHash file.iso -Algorithm SHA256

Compare the result

1Copy the checksum published by the vendor.
2Run the command above on your downloaded file.
3Compare the two values character by character; hex case doesn't matter, but every digit does.
4Or paste both into a verifier tool that reports match or mismatch for you.

If it doesn't match

Re-download the file; interrupted or flaky downloads are the usual cause.
Make sure you compared the right algorithm (SHA-256 vs SHA-1 vs MD5) and the right file version.
Check you didn't copy extra whitespace.
If it still fails, don't run the file; get it from an official source again.

Frequently asked questions

+What is a file checksum?

A short fingerprint computed from a file's contents. Any change to the file produces a different checksum.

+Which algorithm should I use to verify downloads?

SHA-256 is the common standard. Use whichever algorithm the publisher lists.

+Does a matching checksum mean the file is safe?

It means it matches the published one. It is only as trustworthy as the source of the checksum.

+How do I check a SHA-256 hash on Windows?

Run Get-FileHash file -Algorithm SHA256 in PowerShell, or certutil -hashfile file SHA256 in Command Prompt.

Checksum Verifier

Free, runs in your browser — nothing you enter is uploaded.

Open tool →