How to Verify a File Checksum (SHA-256) on Windows, Mac and Linux

To verify a file checksum, calculate the file's SHA-256 hash on your own computer and compare it with the value the publisher lists on its download page. On Windows run Get-FileHash in PowerShell or certutil -hashfile in Command Prompt, on a Mac run shasum -a 256, and on Linux run sha256sum. If the two values match exactly, your copy is identical to the one the publisher hashed. If they differ by a single character, don't open or install the file.

That short string of letters and numbers next to a download button is easy to scroll past. It's worth thirty seconds, because it's the simplest way to prove the file on your disk is the one the developer released.

Below are the exact commands for each system, a way to let the computer compare for you, GPG signature basics and what to do when the numbers don't match.

In this guide:

• What a checksum is and what it proves
• Which hash algorithm should you use?
• How to verify a SHA-256 checksum on Windows with PowerShell
• How to check a hash with certutil in Command Prompt
• How to verify a checksum on a Mac with shasum
• How to verify a checksum on Linux with sha256sum
• Let the computer compare the hash for you
• GPG signatures: the step that proves who published the file
• What a checksum mismatch means and what to do
• Common mistakes when checking file hashes
• Quick reference: checksum commands for every system
• Frequently asked questions

What a checksum is and what it proves

A checksum (also called a hash or digest) is a fixed-length fingerprint worked out from every byte of a file. Feed the same file into SHA-256 and you get the same 64-character answer every time. Change one byte, even a single full stop in a text file, and the answer changes completely.

So it answers one question: is my copy byte-for-byte identical to the one this value was made from? It catches:

• downloads that were cut short or corrupted on the way;
• the wrong file, such as the ARM build when you wanted x64;
• a file that was swapped or altered on a mirror or in transit.

It doesn't tell you the software is safe or that the person who published the hash is trustworthy. If an attacker can change the file on a website, they may be able to change the hash printed beside it too. Signatures solve that, as you'll see below.

Hashes are almost always written in hexadecimal (0-9 and a-f) because it's easy to compare by eye. If you've wondered how that differs from other text encodings, my guide to what Base64 encoding is compares hex and Base64 side by side.

Which hash algorithm should you use?

Use whatever the publisher lists, and prefer SHA-256 or SHA-512 when there's a choice. You can usually tell the algorithm from the length of the value:

The US National Institute of Standards and Technology keeps the official list of approved algorithms on its hash functions project page, including its plan to retire SHA-1 by the end of 2030. An MD5 match only rules out accidental corruption.

How to verify a SHA-256 checksum on Windows with PowerShell

PowerShell is built into Windows 10 and Windows 11, and its Get-FileHash cmdlet uses SHA-256 unless you ask for something else.

1. Open the folder that holds your download in File Explorer.
2. Right-click an empty space in the folder and choose Open in Terminal (on Windows 10, hold Shift while you right-click and choose Open PowerShell window here).
3. Type the command below, replacing the file name with yours. Pressing Tab after the first few letters fills the name in for you.
4. Press Enter and wait.
5. Compare the value in the Hash column with the one on the download page.

Get-FileHash .\installer.exe

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          5891B5B522D5DF086D0FF0B110FBD9D21BB4FC7163AF34D08286A2E846F6BE03       C:\Users\you\Downloads\installer.exe

PowerShell prints the hash in capital letters, while most websites use lower case. That's fine: hex isn't case-sensitive, so 5891B5 and 5891b5 are the same value.

For another algorithm, add -Algorithm followed by SHA1, SHA384, SHA512 or MD5. Microsoft's Get-FileHash reference lists every option, including how to hash a whole folder of files at once.

How to check a hash with certutil in Command Prompt

If you prefer Command Prompt, certutil does the same job and ships with every current version of Windows.

1. Press the Windows key, type cmd and open Command Prompt.
2. Move to your Downloads folder with cd %USERPROFILE%\Downloads.
3. Run certutil -hashfile with the file name and the algorithm.
4. Read the hash on the second line of the output.

certutil -hashfile installer.exe SHA256

SHA256 hash of installer.exe:
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03
CertUtil: -hashfile command completed successfully.

Don't leave off the algorithm name. Without it, certutil falls back to SHA-1, which won't match a SHA-256 value however correct your file is. It also accepts MD5, SHA384 and SHA512. The full syntax is in Microsoft's certutil documentation.

How to verify a checksum on a Mac with shasum

macOS includes shasum, a Perl-based tool that handles the whole SHA family. You choose the algorithm with -a.

1. Open Terminal from Applications > Utilities, or search for it with Spotlight (Command + Space).
2. Type shasum -a 256 followed by a space.
3. Drag the downloaded file from Finder into the Terminal window. macOS types its full path for you.
4. Press Return and compare the result with the published value.

shasum -a 256 ~/Downloads/installer.dmg
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03  /Users/you/Downloads/installer.dmg

The output is the hash, two spaces, then the file name. Use -a 512 for SHA-512 or -a 1 for SHA-1. For an MD5 value, macOS has a separate md5 command.

If you've downloaded a checksum file as well (often called SHA256SUMS or installer.dmg.sha256), put it in the same folder and run shasum -a 256 -c SHA256SUMS. You'll see OK or FAILED next to each file it can find.

How to verify a checksum on Linux with sha256sum

Every mainstream Linux distribution ships GNU coreutils, which includes sha256sum, sha512sum, sha1sum and md5sum. They all work the same way.

1. Open a terminal and move to your download folder with cd ~/Downloads.
2. Run sha256sum followed by the file name.
3. Compare the 64-character result with the publisher's value.

sha256sum ubuntu.iso
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03  ubuntu.iso

The real strength on Linux is check mode. Many projects publish one SHA256SUMS file listing a hash for every download. Save it next to your file and run:

sha256sum -c SHA256SUMS --ignore-missing
ubuntu.iso: OK

The --ignore-missing flag tells it to skip files in the list that you didn't download, so you only see results for the ones you have. Without it, you'll get a "No such file or directory" warning for every other entry. The sha256sum manual page covers the remaining options, including --strict and --quiet.

Let the computer compare the hash for you

Comparing 64 characters by eye is where mistakes creep in. People check the first and last few characters and assume the middle matches. Copy the published value from the website and let the system do the comparison instead.

On Mac and Linux, put two spaces between the hash and the file name. In PowerShell, -eq ignores case, so capital-letter output still matches a lower-case value.

If you get False or FAILED, check for a stray space copied from the web page first.

GPG signatures: the step that proves who published the file

A checksum proves your file matches a value. A digital signature proves who produced that value. Serious projects (Linux distributions, Tor, password managers, many open-source tools) sign their checksum file with a GPG key, so an attacker would need the developer's private key to fake it.

The usual process looks like this, using Ubuntu's file names as an example:

1. Download the file, the SHA256SUMS file and its signature, SHA256SUMS.gpg, from the official site.
2. Install GnuPG if you don't have it: it's preinstalled on most Linux systems, available as Gpg4win on Windows and as GPG Suite or via Homebrew (brew install gnupg) on a Mac.
3. Import the project's public signing key using the key ID or fingerprint the project publishes, for example gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys KEY-ID.
4. Check the fingerprint against the one on the project's website.
5. Verify the signature with gpg --verify SHA256SUMS.gpg SHA256SUMS.
6. If it reports a good signature, run the checksum check from the previous sections against that signed file.

You're looking for Good signature from followed by the project's name. If you see BAD signature, stop. GnuPG will often add a warning that the key "is not certified with a trusted signature". That's normal on a personal machine; it means you haven't personally vouched for the key, which is why step 4 matters. Ubuntu's own guide to verifying an Ubuntu download walks through this with real key IDs.

Windows and macOS apps also carry code signatures. In PowerShell, Get-AuthenticodeSignature .\installer.exe shows whether a Windows installer is validly signed and by whom. On a Mac, Gatekeeper checks signatures and notarisation automatically when you open an app.

What a checksum mismatch means and what to do

A mismatch tells you the file isn't the one the value was made from, but not why. These are the usual causes, most common first:

If a second download from the project's own website still doesn't match, don't open the file, and don't "just try it in case". Delete it, check you're on the genuine site (look-alike domains are common), and let the developers know through their official support or issue tracker.

Common mistakes when checking file hashes

• Getting the hash from the same untrusted place as the file. If you downloaded from a mirror, take the hash from the project's official HTTPS site, or better, a signed checksum file.
• Hashing the extracted contents instead of the download. The published value is for the ZIP, ISO or installer exactly as downloaded. Check it before unzipping.
• Checking a file you've already run. Verify before opening an installer, not after.
• Confusing file checksums with password hashes. A file checksum is meant to be fast and repeatable. Password storage needs slow, salted hashing, which is a different job entirely; my PHP password_hash example shows how that works.

Quick reference: checksum commands for every system

Bookmark this table for the next download page that lists a SHA-256 value.

Frequently asked questions

What is a SHA-256 checksum?

It's a 64-character fingerprint calculated from every byte of a file using the SHA-256 algorithm. The same file always gives the same value, and any change to the file gives a completely different one, so comparing values shows whether two files are identical.

How do I check a SHA-256 hash in Windows 11?

Open Terminal or PowerShell in the folder with your file and run Get-FileHash followed by the file name. It uses SHA-256 by default. In Command Prompt, run certutil -hashfile followed by the file name and SHA256.

Is the hash case-sensitive?

No. Hexadecimal hashes aren't case-sensitive, so a value in capital letters from PowerShell matches the same value in lower case on a website. Every character still has to be the same.

Why doesn't my checksum match?

The most common reasons are an incomplete download, comparing against the hash for a different file or version, or using the wrong algorithm, such as SHA-1 instead of SHA-256. Download the file again from the official site and recheck before assuming tampering.

Is MD5 still OK for checking downloads?

MD5 can still spot accidental corruption, but it's broken against deliberate tampering because different files can be made to share the same MD5 value. Use SHA-256 or SHA-512 when the publisher offers them.

Does a matching checksum mean the file is safe?

Not by itself. It proves your file is identical to the one the published value came from. If that value came from a compromised page, both could be malicious, so check signatures where available and only download from official sources.

What's the difference between a checksum and a GPG signature?

A checksum checks that the file wasn't changed. A GPG signature checks who produced the checksum file, using the developer's private key, so an attacker can't fake it without that key. Use both when a project provides them.

Do I need to install anything to check a hash?

No. Windows has Get-FileHash and certutil, macOS has shasum, and Linux has sha256sum built in. You only need extra software, such as GnuPG, if you also want to verify a signature.

Last checked: 22 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.