How do I verify a SHA-256 checksum?
Hash your downloaded file and compare the result with the checksum the site published. On Windows run certutil -hashfile yourfile SHA256; on Mac or Linux run shasum -a 256 yourfile; or drop the file into a browser hash tool built on WebCrypto. If every character matches, the file arrived intact.
- Find the published checksum. Download pages list it near the file link, often as a SHA256SUMS file or a long hex string labelled SHA-256. Copy it.
- Hash your downloaded copy. Command line: certutil -hashfile file.iso SHA256 (Windows) or shasum -a 256 file.iso (Mac/Linux). No terminal handy? Drop the file into the hash generator below — WebCrypto computes it locally in seconds.
- Compare the two strings. Paste both somewhere visible and compare. Identical means the file is byte-for-byte what the publisher released. Any difference — even one character — means a corrupted or tampered download: delete it and fetch it again, ideally from a mirror you trust.
About two minutes. A match rules out download corruption and silent tampering in transit — which is the entire reason serious projects publish checksums at all.
What a matching checksum actually proves
SHA-256 is a fingerprint: any change to the file, however small, produces a completely different hash. A match proves your copy is identical to what the checksum describes. Note the limit: if an attacker controls the download page itself, they can swap both file and checksum — for that threat, projects add PGP signatures on the checksum file.
Why verify in the browser at all?
Because the checksum workflow exists precisely because you distrust the path the file travelled — so uploading that file to a "free checksum site" would be self-defeating. A WebCrypto-based tool reads the file locally and computes the digest on your device; nothing is transmitted. It is the same primitive certutil and shasum use, minus the terminal.
MD5 and SHA-1 checksums on old download pages
You will still meet them. They detect accidental corruption fine, but both are cryptographically broken — collisions can be manufactured — so they no longer prove authenticity against a deliberate attacker. If a site offers a choice, always verify against the SHA-256.
Tools for this job
Frequently asked questions
The checksums do not match. What now?
Delete the file and download it again — most mismatches are interrupted or corrupted transfers. If it fails twice from the same source, fetch from an official mirror and treat the first source with suspicion.
Is comparing by eye reliable?
Check the first and last eight characters at minimum; better, paste both strings into a diff or search so your tools do the comparison. Sixty-four hex characters are easy to misread.
Can a huge file be hashed in the browser?
Yes — hashing is fast and local. Multi-gigabyte ISOs take a few seconds; the limiting factor is disk read speed, not the browser.