Verify a SHA-256 Checksum

The Short Answer

A SHA-256 checksum is a fingerprint of a file. If the fingerprint of your download matches the one the publisher lists, you have exactly their file: nothing is missing and nothing changed on the way.

You don't need the command line to check it. A browser-based checker reads the file on your own computer and compares the two values for you.

Verify a Download in Five Steps

1. Find the published checksum. It is usually next to the download link, or in a file named something like SHA256SUMS or file.iso.sha256. Use the publisher's own website.
2. Open the file checksum tool. It works in any modern browser on Windows, Mac, Linux, iPhone or Android.
3. Paste the expected value. Copy the long string of letters and numbers and paste it into the expected hash box. Capitals and spaces don't matter, and a whole line like <hash>  file.iso is fine too.
4. Choose the downloaded file. Or drag it onto the page. It is read in pieces, so a multi-gigabyte ISO works. A progress bar shows how far it has got.
5. Read the result. A green “Match” means the file is the one the publisher hashed. A red “Does not match” means it isn't: download it again.

The tool works out the algorithm from the length of what you paste, so you can also check MD5, SHA-1 and SHA-512 values the same way.

Which Checksum Did They Give You?

For example, the SHA-256 of an empty file is always e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855: 64 characters.

Things That Trip People Up

• Comparing the wrong line. A SHA256SUMS file lists many files. Copy the line for the exact file you downloaded, including the right version and architecture.
• Comparing different algorithms. An MD5 will never match a SHA-256 of the same file. Check the length.
• A download that is still running. Until it finishes, the file is incomplete and can't match. Wait for the browser to say it is done, then check the final file.
• Capital letters. They don't matter. 3CBC… and 3cbc… are the same value.
• Trusting a checksum from the same place as the file. If someone could swap the download, they might swap the checksum on that page too. A checksum proves the file is intact, and proves more when it comes from the publisher's main site or is signed.

Platform Notes: The Built-In Commands

If you are comfortable with a terminal, every desktop system can do this without installing anything:

• Windows (PowerShell): Get-FileHash C:\path\to\file.iso. Microsoft's documentation says SHA256 is the default; add -Algorithm SHA512 or -Algorithm MD5 for others. It prints the hash in capitals.
• Windows (Command Prompt): certutil -hashfile C:\path\to\file.iso SHA256.
• Mac: in Terminal, shasum -a 256 /path/to/file.iso.
• Linux: sha256sum file.iso, or sha256sum -c SHA256SUMS to check a whole list.

These commands print the hash and leave the comparing to you, which is where people slip: comparing the first few characters by eye is not enough. Pasting both values into the checker compares all of them.