How to verify a download with its checksum

Downloads sometimes arrive damaged, and now and then they are swapped for something else on the way. A checksum is a quick way to find out which file you actually received, before you open it.

What a checksum is

A checksum, or hash, is a fingerprint worked out from every byte of a file. The result is a short string of letters and digits. SHA-256 gives 64 of them. The same file always gives the same fingerprint, and changing even one bit gives a completely different one.

So the check is simple. The publisher works out the hash of their file and prints it. You work out the hash of the file you got. If the two strings are identical, so are the files.

Where to find the publisher’s hash

Look on the page you downloaded from, near the download button or in a section called Checksums or Verify. Some projects publish a small text file beside the download, often named something like SHA256SUMS, with one hash per line followed by the file name.

Use a hash from the publisher’s own site. A hash on a forum post or a third-party mirror is only as trustworthy as that place. The next article, what a hash proves, and what it doesn’t, explains why.

Option 1: in your browser

The file hash checker needs nothing installed, so it works on a phone, a tablet or a locked-down computer.

1. Choose the downloaded file.
2. Paste the publisher’s hash into the box. The tool works out whether it is MD5, SHA-1, SHA-256 or SHA-512 from its length, and accepts a line copied from a checksum file.
3. Wait for the progress bar on a large file.
4. Read the result.

The file is read in your browser and is not uploaded. As a worked example, the Silo decrypt tool page lists a SHA-256 beside its download, so you can try the whole process on a file where the answer is published.

Option 2: a terminal command

On a computer you can skip the browser. Replace FILE with the file’s name, and run the command in the folder that holds it.

macOS

shasum -a 256 FILE

Linux

sha256sum FILE

Windows, in Command Prompt

certutil -hashfile FILE SHA256

Windows, in PowerShell

Get-FileHash FILE

PowerShell uses SHA-256 unless you add -Algorithm with another name. Each command prints a long string. Put it next to the one on the page and compare them. For a long string it helps to check the first eight and the last eight characters and the length, or to paste both into a text editor, one under the other.

If the publisher gives a checksum file, Linux can compare for you. Run sha256sum -c SHA256SUMS with the file in the same folder, and it prints OK for each file that matches.

If the hashes match

Your copy is identical to what the publisher hashed. You can open it, subject to the usual questions about whether you trust the publisher.

If they don’t match

Don’t open the file. In the order they are likeliest:

1. The download was cut short or damaged. A dropped connection is the usual cause. Delete the file and download it again, then check again.
2. You compared the wrong thing. Check that you copied the whole hash, that it is for the same file and version, and that you are using the same algorithm.
3. The file was changed. This is rare, but it is what the check exists to catch. If a fresh download from the official page still doesn’t match, don’t use the file, and tell the publisher.