How to verify a file checksum

A checksum is a short fingerprint calculated from a file. Publishers list the checksum of each release. If the fingerprint of your download matches, you have exactly the same bytes they published, with nothing corrupted and nothing swapped.

The fastest way: in your browser

Open our checksum verifier, choose the file, paste the publisher’s SHA-256 and click Verify. The file is hashed locally with the Web Crypto API and never uploaded.

Windows (PowerShell)

Get-FileHash "C:\Users\you\Downloads\installer.exe" -Algorithm SHA256

Compare the Hash value with the published one. Case doesn’t matter.

To compare automatically:

(Get-FileHash .\installer.exe -Algorithm SHA256).Hash -eq "PASTE_EXPECTED_HASH"

macOS (Terminal)

shasum -a 256 ~/Downloads/app.dmg

Linux

sha256sum ~/Downloads/distro.iso
# or check against a SHA256SUMS file from the publisher:
sha256sum -c SHA256SUMS --ignore-missing

What a mismatch means

• Don’t open or run the file.
• Download again from the official source. Corruption in transit does happen.
• If it still doesn’t match, the file was altered or you’re using the wrong reference hash. Contact the publisher.

Where the expected hash comes from matters

A hash only proves the file matches the reference you compared against. If an attacker controls the download page, they can change both. So:

• Take the expected hash from the publisher’s official HTTPS page, not from a mirror or forum.
• Prefer releases with a digital signature (GPG or code signing). A signature ties the hash to a key the attacker doesn’t have.

Which algorithm?