How to check a download is genuine with its checksum

Guides · Updated 12 October 2026 · By Tiago Santos

Download pages for software, operating systems and firmware often list a long code next to the file, labelled SHA-256 or “checksum”. It lets you prove the file you downloaded is exactly the one the publisher released: not corrupted on the way, and not swapped for a tampered copy.

What a checksum is

A checksum, or hash, is a fingerprint calculated from every byte of a file. Change a single byte and the fingerprint changes completely. If the fingerprint of your download matches the one the publisher lists, the files are identical.

SHA-256 is the standard today. You may still see MD5 or SHA-1 on older sites; they’re fine for spotting a broken download, but no longer safe against deliberate tampering.

Check it in your browser

1. Open File checksum and paste the checksum from the download page.
2. Choose the downloaded file. It’s hashed on your device, even if it’s several gigabytes.
3. You see “Match” or “No match”. If there’s no match, delete the file and download it again from the official site.

On Windows

Open PowerShell and run Get-FileHash path\to\file. It prints the SHA-256 hash. In Command Prompt, certutil -hashfile path\to\file SHA256 does the same.

On Mac and Linux

Open Terminal and run shasum -a 256 path/to/file on a Mac, or sha256sum path/to/file on Linux.

Hashing text instead of a file

Developers sometimes need the hash of a piece of text, for example to compare API signatures. Hash generator shows MD5, SHA-1 and SHA-256 to SHA-512 as you type, and HMAC with a secret key.

One caution

A checksum only proves a file matches what the page lists. If a site itself were compromised, both could be replaced. For high-stakes software, publishers also sign their releases; the checksum is still the quick, practical check for everyday downloads.