Is your download corrupted or tampered with? Check it with SHA-256

You have downloaded an installer or a disk image. Right next to the download link sits a meaningless-looking string of 64 letters and digits, labelled SHA-256. Maybe the installation stopped halfway with an error, or you grabbed the file from a mirror instead of the official site and something feels off. That string is published for exactly this moment: in about two minutes it tells you whether the file on your disk is byte-for-byte the file the publisher prepared.

This guide explains what the value means, how to work out your own file's value in the browser, on Windows and on a Mac, and what to check, in order, when the two values disagree. You can do all of it without touching the command line; if you like commands, they are here too.

What is that long string on the page telling you?

Once the publisher has built the file, they calculate its hash and print it on the page. A hash is a kind of fingerprint, always the same length, computed from every single byte of the file: a 4 GB disk image and a 200 KB document both produce a 64-character value with SHA-256. You run the same calculation on your copy. If the two values are identical character for character, your file is the publisher's file; if even one character differs, it is not.

In other words, this is not a password or a licence key, and you never type it in during installation; it exists only to be compared. Where it appears varies from site to site: next to the link under a heading such as "SHA-256", "Checksum" or "Hashes", or as a separate text file called SHA256SUMS. Linux distributions and open-source projects tend to use that second option; view it in Notepad or TextEdit and every line shows a hash followed by a file name.

Checking in the browser, no commands needed

Open the Hash Generator and drop the downloaded file onto the box, or click it to pick the file. Copy the value from the download page, paste it into the Expected checksum field and press Calculate hash. The file's row then shows one of two verdicts: it matches the expected checksum, or it does NOT match. You never have to compare 64 characters by eye.

Do not worry about how neatly you copied the value. The tool ignores upper and lower case and any spaces, and strips a prefix such as "sha256:". You can even paste a whole line from a SHA256SUMS file, file name included, and it will pick out the hash. If you chose the wrong algorithm from the list, it recognises the algorithm from the length of the value you pasted and compares against that one instead.

The one limit worth knowing is size: the file is read into the browser's memory, so the tool accepts up to 1 GB per file. For larger disk images, use the commands in the next section. The calculation happens entirely on your computer; the file is never sent to a server.

One command on Windows or Mac

There is nothing to install; both systems ship with what you need. On Windows, open the folder that holds the file in File Explorer (usually Downloads), click the address bar at the top, type cmd and press Enter: Command Prompt opens already pointed at that folder. On a Mac, Terminal lives in Applications > Utilities, or press Command + Space and type "Terminal" into Spotlight.

• If the file name contains spaces, put it in quotes: "New Version.exe"
• PowerShell prints the value in capitals while the page may use lower case; they are the same value
• If you compare by eye, do not stop at the first and last few characters; select the value, copy it with Ctrl+C and put it under the published one in a text document

The values do not match: what to check, in order

A mismatch is usually an ordinary hiccup rather than an attack. Before deleting anything, go through these four points; the first three take seconds.

• Same algorithm? A 64-character value is SHA-256, 128 is SHA-512, 40 is SHA-1 and 32 is MD5; you may have calculated a different one
• Right line? Download pages often list 32-bit, 64-bit, ARM and older releases separately, and every one of them has its own hash
• Did the download finish? Compare the file size with the size shown on the page; a name ending in .crdownload or .part means the download was cut short
• If all of that checks out, do not open the file: delete it and download it again, ideally from the publisher's own site; if the second copy fails too, do not install it

When the page only gives MD5 or SHA-1

Some older sites still publish only MD5 or SHA-1. Checking those values is still worthwhile: they reliably catch a file that was cut short or damaged while copying, because accidental damage that happens to produce the same hash is, in practice, impossible.

What they cannot catch is a deliberately crafted fake. Researchers showed in 2004 for MD5, and in 2017 for SHA-1, that two different files with the same hash can be built on purpose; in the SHA-1 case they published two different PDFs sharing one hash. Someone who alters a file can therefore make it match an old-style hash. If the page offers several values, pick the longest, and at the very least SHA-256.

What a match proves, and what it does not

A match proves that your file is the same as the file held by whoever published the value. It does not prove the file is harmless: if the publisher put out something malicious, the hash belongs to that malicious file. So before you look at the hash, look at who the file comes from.

Where the value comes from matters too. If you got the file from a mirror, a forum or a file-sharing site, copy the hash from the publisher's own official page. A hash sitting next to the file may have been changed by the same person who changed the file. That is why large projects also sign their hash lists digitally; files ending in .sig, .asc or .gpg on the download page are those signatures. Checking a signature needs a separate program such as GnuPG, and the Hash Generator does not do it; for everyday use, a SHA-256 match against the official page is a sound check in most situations.

When you are the one sending the file

The same method works the other way round. If you are sending someone a large archive, a draft contract or a backup, calculate its SHA-256 hash with the Hash Generator first and download the small checksum file it offers. That text file holds the hash and the file name in the layout that the sha256sum command on Linux can read.

Send the hash through a different channel from the file itself: if the file went out as a sharing link, write the value in a message. When the recipient calculates the hash of their copy and compares it with yours, both of you can be sure the file was neither damaged on the way nor altered by anyone else.

Frequently asked questions

The page shows the value in capitals and mine is in lower case. Is that a problem?

No. A hash is written in hexadecimal, where a and A are the same digit. PowerShell prints capitals, while certutil, macOS and Linux print lower case; ignore the letter case when comparing.

Does renaming the file change its hash?

No. The hash is calculated from the file's contents only; its name, folder and dates play no part. Even if your browser saved it as "setup (1).exe", the hash will still match the published value.

The download page publishes no hash at all. What can I do?

You cannot compare with the publisher, but you can still test the download itself: download the file twice at different times and calculate both hashes together in the Hash Generator. If they are identical, at least nothing went wrong in transit.

The hash matches but my antivirus warns about the file. Which should I trust?

They answer different questions. A match says the file is the same as the publisher's; the antivirus judges whether the contents look harmful. If you do not trust the publisher, a match does not protect you. When in doubt, do not run the file and check the publisher's support page.

Can I check a file I downloaded on my phone?

Yes. The Hash Generator also opens in a phone browser; tap the box and pick the file from Downloads or the Files app. Very large files may need more memory than the phone can spare, in which case do the check on a computer.

Last updated: October 12, 2026