How to Verify a File Checksum (SHA-256) on Windows, Mac or Online

The short answer

To verify a download, calculate its SHA-256 checksum and compare it with the checksum published by the software's official website. If every character matches, the file is exactly the one the publisher released. You can do this in the browser with the Hash Generator (Hash file tab, SHA-256 line), in Windows PowerShell with Get-FileHash, on macOS with shasum -a 256, or on Linux with sha256sum.

What a checksum proves

A hash function turns any file into a short, fixed-length fingerprint. SHA-256 produces 64 hexadecimal characters. Change a single byte of the file and the fingerprint changes completely.

When a publisher lists a SHA-256 value next to a download, comparing it tells you:

• The download is complete. A truncated or corrupted file gives a different hash.
• The file has not been swapped, as long as you got the checksum from a trustworthy place, such as the official site over HTTPS or a signed release page.

What it does not prove: that the software itself is safe. A checksum copied from the same compromised mirror as the file proves nothing. Always take the checksum from the official source.

Method 1: in the browser

Open the Hash Generator and switch to the Hash file tab.

Click the box and choose the downloaded file.

The tool reads the file on your device and shows SHA-1, SHA-256, SHA-384 and SHA-512 values. The file is not uploaded.

Copy the SHA-256 value (hover over the row to see the Copy button) and compare it with the published one.

Use the SHA line that matches what the publisher lists. Note that the tool's MD5 line is meant for hashing text typed into the Hash text tab, so do not use it to check files; if a publisher only provides an MD5 checksum, use one of the command-line methods below.

The browser method loads the whole file into memory, so it suits typical downloads such as installers, PDFs and archives. For very large files such as multi-gigabyte disk images, the command line is faster and more reliable.

Method 2: Windows (PowerShell)

Open PowerShell (search for it in the Start menu).

Run the command below, replacing the path with your file's location:

Get-FileHash "C:\Users\you\Downloads\setup.exe"

Get-FileHash uses SHA-256 when you do not specify an algorithm. For another algorithm, add -Algorithm SHA512 or -Algorithm MD5. The result appears in the Hash column in capital letters.

The older Command Prompt alternative is certutil -hashfile setup.exe SHA256.

Method 3: macOS

Open Terminal and run:

shasum -a 256 ~/Downloads/file.dmg

Tip: type shasum -a 256 (with a space), then drag the file from Finder into the Terminal window to paste its path.

Method 4: Linux

sha256sum file.iso

Many projects publish a SHA256SUMS file listing checksums for every download. Put it in the same folder as your download and run sha256sum -c SHA256SUMS --ignore-missing to check automatically. Each file is reported as OK or FAILED.

A worked example

We created a text file containing hello world followed by a newline and hashed it with sha256sum and shasum -a 256. Both returned:

a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447

Remove the final newline and the hash is completely different. That is why checksums catch even tiny changes, and why "almost the same" never counts as a match.

Where to find the official checksum

Look for it on the same official page that offers the download, often labelled "SHA-256", "checksum", "hash" or "verify". Open-source projects usually list checksums on their release page or in a file named SHA256SUMS or checksums.txt next to the downloads. Some also publish a digital signature for that file, which lets you confirm the checksum list itself came from the project.

Be wary of a checksum shown only on a third-party download mirror, in a forum post or in a chat message. If someone could swap the file, they could swap the checksum next to it too.

Comparing the values without mistakes

Comparing 64 characters by eye is error-prone. Better ways:

• Use search. Copy your computed hash, open the publisher's checksum page, press Ctrl+F (Cmd+F on Mac) and paste. If the browser finds it, it matches.
• Ignore letter case. A9489... and a9489... are the same value. PowerShell prints capitals, most other tools print lowercase.
• Check the whole string, not just the first and last few characters.
• Make sure you compare the right file. Release pages often list checksums for many versions and platforms (Windows, macOS, ARM, x64).

If the checksums do not match

Check you used the same algorithm. A SHA-256 value never matches a SHA-1 or MD5 value; they even have different lengths (see the table below).

Check the version. You may have downloaded 2.4.1 but compared it with the 2.4.0 checksum.

Download again from the official site, ideally on a different connection. Interrupted downloads are the most common cause.

Still different? Do not run the file. Delete it and report the problem to the publisher.

Algorithm	Length in hex characters
MD5	32
SHA-1	40
SHA-256	64
SHA-384	96
SHA-512	128

Which algorithm to trust

• SHA-256 or SHA-512: the standard choice today for verifying downloads.
• SHA-1 and MD5: fine for spotting accidental corruption, but researchers have shown practical ways to create two different files with the same MD5 or SHA-1 hash. Prefer SHA-256 whenever it is offered.

For more background on how these algorithms differ, read what MD5, SHA-1 and SHA-256 are.

Related tools

• To hash a short piece of text, such as an API test value, use the Hash text tab of the Hash Generator or the MD5 Generator.
• To store passwords, do not use a plain hash. Use a slow password hash such as bcrypt; you can experiment with the Bcrypt Generator.