How to verify a downloaded file with a checksum
On many download pages, next to the file link you will see a label like SHA256 or MD5 followed by a long string of letters and numbers. That string is a checksum. Comparing it takes a minute, and it tells you for certain whether the file you got is exactly the file the publisher released.
What is a checksum?
A checksum is a fixed-length value produced by running a file's contents through a hash function. The same file always gives the same value, no matter when or where you compute it, while changing even a single byte gives a completely different value. So if the value the publisher lists matches the value you compute, the two files are effectively identical.
There are two main reasons to check. The first is corruption during download. The bigger the file, the more likely this is, and a corrupted install image tends to fail halfway through with confusing errors. The second is tampering, when you download from a mirror or a shared link instead of the official site and someone has replaced the file. If the checksum does not match the value on the official site, do not use that file.
Which hash type should you look at?
The length of the value tells you roughly which type it is.
| Type | Hex length | Notes |
|---|---|---|
| MD5 | 32 | Old but still common. Fine for catching corruption |
| SHA-1 | 40 | Known attacks can create matching values on purpose |
| SHA-256 | 64 | The most common today. Recommended |
| SHA-512 | 128 | Longer and stronger |
If the site lists several values, use SHA-256 or stronger. MD5 and SHA-1 are fine for spotting accidental damage, but you cannot rely on them to catch a deliberately crafted file.
Check it right in your browser
- Copy the checksum from the download page. It is fine if it starts with a label such as
SHA256:. - Open the hash and checksum generator below, choose the File tab at the top, and drop in the file you downloaded.
- Paste the copied value into the Compare checksum box on the right.
- If you see "Match", you are good. If it does not match, download the file again and check once more.
The file is read and hashed inside your browser and is never sent over the internet. It can handle install images of several gigabytes, but a desktop computer is faster and more reliable than a phone for that.
Doing it from the command line
You can get the same value with built-in commands, without installing anything.
- Windows PowerShell:
Get-FileHash filename -Algorithm SHA256 - macOS Terminal:
shasum -a 256 filename - Linux:
sha256sum filename
The command output and this tool's result may differ only in upper or lower case. The value itself must be the same, and case does not matter.
If the values do not match
- Are you comparing different types? A SHA-256 value and an MD5 value have different lengths. The tool tells you which type a value is from its length.
- Is it the value for a different file? When a page lists several versions or operating systems, there are several values. Use the one on the same line as your exact file name.
- Did the download finish? First check that the file size matches the size listed on the download page.
If the value still differs after downloading again a few times, do not use that file. Get it directly from the official site instead. It is a one-minute check, but it can save you hours of chasing a broken installer or keep you from running a dangerous file.