How to Verify a File Checksum (SHA-256 and MD5)
Software sites often publish a long string of letters and numbers next to the download button. That's a checksum, and comparing it takes less than a minute. Here's how to do it on any computer, and what it actually protects you from.
Quick answer
Calculate the file's hash and compare it with the one published by the developer. In your browser, drop the file into a hash generator and paste the expected checksum. On Windows, run Get-FileHash file.zip in PowerShell. On Mac, run shasum -a 256 file.zip. On Linux, run sha256sum file.zip. If the values match exactly, the file is intact.
What is a checksum?
A checksum (or hash) is a short fingerprint calculated from a file's contents. The same file always gives the same hash, but changing even a single bit produces a completely different one. By comparing your hash with the developer's, you can confirm that the file you downloaded is byte-for-byte identical to the original.
Why verify downloads?
- Corruption. Interrupted downloads and faulty storage can damage files, leading to failed installs or broken disk images.
- Tampering. If a mirror or download site was compromised, the file may contain malware. A mismatched checksum is a red flag.
- Large files. OS images (ISOs), firmware and backups are worth checking before you flash or restore them.
Important: a checksum only helps if you get it from a trusted source, ideally the developer's official HTTPS website. If attackers control the download page, they can change both the file and the checksum. For high-security software, developers also publish digital signatures (for example, GPG signatures) that prove who created the file.
Method 1: In your browser (any OS)
- Open the free Hash Generator and switch to the File tab.
- Drop the downloaded file. MD5, SHA-1, SHA-256, SHA-384 and SHA-512 are calculated together.
- Paste the published checksum into the verify box.
- If it matches, the matching algorithm is highlighted.
The file is hashed locally with your browser's Web Crypto engine. It isn't uploaded, which also means large files work without waiting for an upload.
Try it free: Hash Generator
Generate MD5, SHA-1, and SHA-256 hashes for text and files. Runs in your browser, no sign-up.
Method 2: Windows (PowerShell or Command Prompt)
Open PowerShell in the folder with the file and run:
Get-FileHash .\file.zip -Algorithm SHA256Replace SHA256 with MD5, SHA1 or SHA512 as needed. In Command Prompt, use:
certutil -hashfile file.zip SHA256To compare automatically in PowerShell:
(Get-FileHash .\file.zip).Hash -eq "PASTE_EXPECTED_HASH_HERE"It prints True if they match. The comparison isn't case-sensitive.
Method 3: macOS (Terminal)
shasum -a 256 file.zip
md5 file.zipMethod 4: Linux
sha256sum file.zip
md5sum file.zipIf the developer provides a checksum file (often named SHA256SUMS), put it in the same folder and run sha256sum -c SHA256SUMS to check everything at once.
MD5 vs SHA-1 vs SHA-256
| Algorithm | Hash length | Security status | Use it for |
|---|---|---|---|
| MD5 | 128 bits (32 hex characters) | Broken: collisions are easy to create | Detecting accidental corruption only |
| SHA-1 | 160 bits (40 hex) | Broken: practical collisions shown in 2017 | Legacy systems only |
| SHA-256 | 256 bits (64 hex) | Secure | Downloads, signatures, the modern default |
| SHA-512 | 512 bits (128 hex) | Secure | When a larger margin is preferred |
"Broken" means an attacker can craft two different files with the same hash. MD5 still catches accidental corruption, but it can't protect against deliberate tampering. Prefer SHA-256 whenever the developer offers it.
What to do if the checksum doesn't match
- Check that you're comparing the same algorithm. A SHA-256 hash (64 characters) will never match an MD5 hash (32 characters).
- Check the version. Make sure the checksum belongs to the exact file and version you downloaded.
- Download again from the official website, not a mirror.
- Still no match? Don't open or install the file. Delete it and contact the developer.
Frequently asked questions
Is uppercase or lowercase important?
No. Hex hashes are the same in uppercase or lowercase. Our tool lets you switch to match the published format.
Can a hash be reversed to get the file back?
No. Hash functions are one-way. You can only compare hashes, not recover the input.
Why do two different files never seem to share a hash?
For secure algorithms like SHA-256, the number of possible hashes is so astronomically large that accidental matches are effectively impossible.
Can I hash text, not just files?
Yes. Use the Text tab to hash any string. Developers use this for cache keys, ETags and data comparisons.
The bottom line
Verifying a checksum takes a minute and protects you from corrupted or tampered downloads. Get the checksum from the official site, prefer SHA-256, and never run a file whose hash doesn't match.
Found something out of date or unclear? Email contact@ultratoolsai.com and we'll fix it.
