How to Verify a File Checksum (SHA-256, MD5)

Compute the file's hash, compare it to the checksum the publisher lists, and confirm they match character for character. One command does it on every platform.

The commands

# Linux
sha256sum ubuntu-24.04.iso

# macOS
shasum -a 256 ubuntu-24.04.iso

# Windows (PowerShell)
Get-FileHash ubuntu-24.04.iso -Algorithm SHA256

Each prints a 64-character hex string. If it matches the published checksum exactly, the file arrived intact. A single differing character means the file is corrupt or has been tampered with — re-download it.

Compare automatically instead of by eye

Eyeballing 64 hex characters is where mistakes happen. Most projects publish a checksum file (often named SHA256SUMS) so the tool can compare for you:

# Verifies every file listed in SHA256SUMS that exists locally
sha256sum -c SHA256SUMS
# ubuntu-24.04.iso: OK

On macOS, shasum -a 256 -c SHA256SUMS does the same.

Why checksums catch problems

A hash function produces a fixed-size fingerprint that changes completely if even one bit of input changes. That makes it ideal for detecting corrupted downloads, truncated transfers, and modified files. If you want the theory, start with what is a checksum.

One caveat: a checksum on the same page as the download only proves integrity, not authenticity — an attacker who replaced the file could replace the checksum too. Projects that care about this also sign the checksum file with GPG.

Which algorithm should you use?

Use SHA-256 whenever the publisher offers it. MD5 and SHA-1 still detect accidental corruption fine, but both are broken against deliberate collisions, so they can't prove a file wasn't maliciously swapped. The trade-offs are covered in MD5 vs SHA-256.

Verify a hash without the terminal

For quick checks — a config file, a license blob, a small download — you can skip the command line entirely. Paste the content into the hash generator, pick SHA-256, and compare the output against the published value.