Run your operating system's built-in hash command against the downloaded file, then compare the result to the checksum the publisher posted. Use PowerShell's Get-FileHash on Windows, sha256sum on Linux, or shasum -a 256 on macOS. If the two strings match exactly (case doesn't matter), the file is intact. Always prefer SHA-256 over MD5 or SHA-1 for anything security-sensitive.
TL;DR:
- Always verify downloads by comparing the file’s SHA-256 hash using built-in OS tools like PowerShell, sha256sum, or shasum, and ensure the hashes match exactly.
- For security-sensitive files, use SHA-256 or stronger algorithms, as MD5 and SHA-1 are cryptographically broken and vulnerable to collision attacks.
- Obtain official checksums from signed release pages or trusted channels, avoiding the same page hosting the download to prevent compromise risks.
- Treat mismatch results as a sign to re-download from a different source, verify the comparison process, or contact the vendor if issues persist.
- Browser-based hash tools allow quick, local checksum verification without file uploads, useful for sensitive or internal files.
Table of Contents
- How Do You Verify a File Checksum on Windows, Linux, and Mac?
- What's the Difference Between a Checksum, a Hash, and a Signature?
- Which Hash Algorithm Should You Actually Trust?
- Where Should You Get the Official Checksum?
- What Should You Do When the Checksum Doesn't Match?
- Can You Automate Checksum Verification With a Script?
- When Is a Quick Hash Check Enough, and When Do You Need More?
- Verify Hashes Without Leaving Your Browser
- Sources
- FAQ
How Do You Verify a File Checksum on Windows, Linux, and Mac?
Every major operating system ships with a command you can run in under ten seconds. No installs, no third-party downloads required.
On Windows, open PowerShell and run:
Get-FileHash .\setup.exe -Algorithm SHA256
This returns a Hash property alongside the file path and algorithm used, and it defaults to SHA256 when you skip the -Algorithm flag, according to Microsoft's documentation. If you're stuck on an older system or prefer the legacy tool, certutil works too:
certutil -hashfile setup.exe SHA256
Certutil supports MD5, SHA1, SHA256, SHA384, and SHA512, per Microsoft's certutil reference.
On Linux, the standard tool is sha256sum:
sha256sum ubuntu-24.04.iso
If the publisher gives you a .sha256 or .sums file, skip manual comparison entirely and run batch verification instead:
sha256sum -c checksums.sha256
This prints OK next to each file that matches, based on the flags documented in the cksum manual page. You'll still see md5sum floating around for older software, but treat it as a sanity check, not a security guarantee.
On macOS, there's no sha256sum by default. Use shasum instead:
shasum -a 256 app-installer.dmg
A few practical notes for a smoother workflow:
- Both
sha256sumandshasumaccept piped input, so you can hash a file mid-stream without saving intermediate copies. - If you'd rather avoid the terminal entirely, a browser-based hash tool that computes locally (using the Web Crypto API) works without uploading anything, which keeps the file private, according to testing on browser hashing tools.
- Always copy the published hash directly rather than retyping it. A single mistyped character produces a false mismatch.
What's the Difference Between a Checksum, a Hash, and a Signature?
A checksum (or hash) is a fixed-length fingerprint generated from a file's exact bytes. Change one bit anywhere in the file, and the output hash changes completely. That's the whole point: it's deterministic, so the same input always produces the same output.
A digital signature is a different animal. Tools like PGP or code-signing certificates authenticate who published the file and protect the published hash itself from tampering. This distinction matters more than most guides admit: a matching hash only proves your downloaded file is byte-for-byte identical to whatever the publisher hashed. It says nothing about whether that original file was safe, unless the hash you're comparing against came from a trustworthy, verified source in the first place.
Which Hash Algorithm Should You Actually Trust?
For installers, firmware, and anything where tampering is a real concern, use SHA-256 or stronger. MD5 and SHA-1 are both considered cryptographically broken. Researchers have demonstrated collision attacks against them, meaning two different files can be crafted to produce the identical hash, according to NIST's guidance on secure hash algorithms.
That doesn't mean MD5 is useless. If a vendor only provides an MD5 checksum, it still catches accidental corruption from a bad download or a flaky mirror. What it can't do is protect you from a deliberately swapped file. The practical rule: if SHA-256 is available, use it. If only MD5 shows up, treat the result as a basic integrity check, not proof the file wasn't tampered with.
Where Should You Get the Official Checksum?
The safest checksums come from signed release pages, GitHub release tags with attached signatures, or the vendor's own HTTPS domain, ideally in a separate file from the download itself. A PGP-signed checksum file lets you verify both the hash and the identity of whoever signed it.
Here's the trap people fall into: copying the checksum from the exact same page that hosts the download. If that page gets compromised, an attacker can swap both the file and the posted hash at once, and your comparison will pass while the file is malicious. Pulling the checksum from a separate, trusted channel closes that gap. When a signed checksum file is available, verifying the signature first, then the hash, gives you the strongest guarantee available to an average user.
What Should You Do When the Checksum Doesn't Match?
A mismatch usually means something fixable, not necessarily a breach.
- Re-download the file from a different mirror or browser, and confirm the file size matches what the publisher lists before assuming anything malicious happened.
- Double-check that you're comparing hashes generated with the same algorithm, and strip stray whitespace or capitalization differences before comparing strings manually.
- If the mismatch persists across a fresh download and a verified algorithm, treat it as a possible tampering event: contact the vendor directly, try an official mirror, or wait for a signed release confirmation.
Can You Automate Checksum Verification With a Script?
Yes, and it's worth doing if you verify downloads more than occasionally.
PowerShell:
$expected = "a1b2c3..."
$actual = (Get-FileHash .\file.exe -Algorithm SHA256).Hash
if ($actual -eq $expected) { "Match" } else { "Mismatch" }
Bash:
sha256sum -c checksums.sha256
This one line handles multiple files at once if your checksum file lists more than one entry, drawing on the same -c verification flag documented for cksum and related utilities.
macOS:
shasum -a 256 file.dmg | awk '{print $1}'
Piping through awk isolates just the hash string, which is handy when feeding it into another script.
- If you're building this into a CI pipeline, Pingfloat's Validate tools are worth a look for tying integrity checks into a broader QA step.
- Hardware and firmware downloads carry the same risk profile as software installers; teams managing networked devices should apply the same separate-channel checksum habit, a point echoed in printer security guidance for IT teams.
Pro Tip: When scripting comparisons, always trim whitespace and force both hashes to lowercase before comparing. Different tools sometimes format hex output differently, and that alone causes false mismatches that have nothing to do with the actual file.
When Is a Quick Hash Check Enough, and When Do You Need More?
Casual users downloading a familiar app can get away with a fast SHA-256 comparison. IT teams handling firmware, installers distributed to end users, or anything crossing a trust boundary need the full chain: signed release, separate-channel checksum, SHA-256 or better. Speed is fine until the download matters enough that being wrong actually costs something. Pingfloat's hashing utilities cover the fast local check either way.
— Andreas
Verify Hashes Without Leaving Your Browser
A browser-based Hash Generator computes MD5, SHA-1, SHA-256, and SHA-512 directly in the browser using local processing, so files never leave your machine during a local hash calculation.
That matters if you're checking a sensitive installer or an internal build and don't want to upload it anywhere just to confirm a hash. Drop the file in, pick your algorithm, and compare the output against whatever checksum the publisher posted, no account or software install needed. If you also need to send that file (and its checksum) to a teammate for their own verification, Pingfloat's File Sharing & Secure File Transfer tool handles the transfer side, so the recipient gets both the file and the value they need to confirm it landed intact. Open the hash generator now and run your next download through it before you install anything.
Sources
- Get-FileHash (Microsoft Docs)
- Man7
- What is a checksum? (Comparitech)
- File Hash & Checksum Verifier – Verify File Integrity Online
FAQ
How do you SHA-256 checksum a file?
On Windows, run Get-FileHash file.ext -Algorithm SHA256 in PowerShell. On Linux, run sha256sum file.ext, and on macOS, run shasum -a 256 file.ext. Compare the resulting hex string to the publisher's posted value.
What does it mean to verify a checksum?
Verifying a checksum means computing a file's hash yourself and comparing it against the value the publisher posted, confirming the file downloaded correctly and matches byte-for-byte. A match confirms integrity against the copy that was hashed; it doesn't automatically confirm the original file was safe unless the published hash itself came from a trustworthy source, per Comparitech's overview of checksum verification.
How do I verify a SHA-256 checksum in Windows 11?
Open PowerShell and run Get-FileHash <filename> -Algorithm SHA256, which is the default algorithm for that cmdlet according to Microsoft's documentation. Then compare the Hash value in the output against the checksum listed on the software's official download page.
How do you generate a checksum for a file?
Run the same hash command you'd use to verify one: Get-FileHash on Windows, sha256sum on Linux, or shasum -a 256 on macOS. The output is the checksum, which you can then share alongside the file so others can confirm it wasn't altered.
Does Pingfloat offer a tool for checking file hashes?
Yes. Pingfloat's Hash Generator computes MD5, SHA-1, SHA-256, and SHA-512 locally in your browser without uploading the file, making it a quick option for both casual checks and more sensitive verification work.