How to Verify a File Checksum (SHA-256, MD5)
Download pages for operating systems, crypto wallets and security software publish a checksum so you can confirm the file you got is exactly the one they released. Checking it takes a minute — here's how on Windows, Mac and Linux, or in your browser without installing anything.
Compute the file's hash and compare it with the checksum published by the developer. Windows: certutil -hashfile file.iso SHA256 (or Get-FileHash in PowerShell). Mac: shasum -a 256 file.iso. Linux: sha256sum file.iso. Or drop the file into an in-browser checker. If every character matches, the file is intact and unmodified; if not, delete it and download again from the official site.
What a checksum proves
A checksum (hash) is a fingerprint of a file's exact bytes. Changing even one bit produces a completely different value, so a match proves your download wasn't corrupted in transit or swapped by a compromised mirror.
It only proves authenticity if the checksum itself is trustworthy — get it from the official site over HTTPS, ideally with a GPG signature. It's not a virus scan: a malicious file published by an attacker matches its own checksum.
Verify a checksum on Windows
Open Command Prompt in the download folder and run: certutil -hashfile yourfile.iso SHA256. Or in PowerShell: Get-FileHash .\yourfile.iso -Algorithm SHA256. Replace SHA256 with MD5 or SHA1 if that's what the site publishes.
Compare the output with the published value — case doesn't matter.
Verify a checksum on Mac and Linux
Mac Terminal: shasum -a 256 yourfile.dmg (or md5 yourfile.dmg). Linux: sha256sum yourfile.iso. If the site provides a SHA256SUMS file, run sha256sum -c SHA256SUMS --ignore-missing in the same folder and look for “OK”.
Verify a checksum online without installing anything
Drop the file into the File Hash Checker: it calculates SHA-256, SHA-512, SHA-1, MD5 and CRC32 in your browser — the file is never uploaded, even multi-gigabyte ISOs — then paste the published checksum to get a clear match or mismatch. For hashing text instead of files, use the SHA-256 Hash Generator.
Which algorithm should I trust?
Use SHA-256 or SHA-512 when available. MD5 and SHA-1 still detect accidental corruption but are broken against deliberate tampering, because attackers can create different files with the same MD5 or SHA-1. CRC32 is only for error detection.
Try Free Web Tools Mentioned in This Guide
File Hash Checker
Verify a downloaded file's checksum (SHA-256, SHA-512, SHA-1, MD5) — or compare two files.
SHA-256 Hash Generator
Generate SHA-256 hashes of text or files instantly — hex or Base64, with checksum comparison.
Checksum Calculator
Calculate CRC-32, Adler-32, 8-bit sum/XOR, MD5, SHA-1 and SHA-256 checksums of text, hex or files.
MD5 Hash Generator
Generate MD5 hashes of text or files instantly — hex or Base64, with checksum comparison.
Frequently Asked Questions
What do I do if the checksum doesn't match?↓
Don't open the file. Delete it and download again from the official source. If it still doesn't match, the download server may be compromised — report it to the developer.
Is SHA-256 the same as a checksum?↓
SHA-256 is one kind of checksum — a cryptographic hash. “Checksum” is the general term, which also covers simpler codes like CRC32.
Can I verify a checksum on my phone?↓
Yes — an in-browser tool like the File Hash Checker works on phones too, as long as you can pick the file.