How to verify a downloaded file with a checksum (SHA-256, MD5)
Make sure an installer or ISO image hasn't been corrupted or tampered with by comparing its SHA-256 checksum with the one the publisher provides.
· 1 min read
Software publishers often list a “checksum” or “hash” next to their downloads — a long string like e3b0c442…b855. Comparing it with the checksum of the file you downloaded proves the file is exactly the one they published.
Why bother?
- Downloads can be corrupted by an interrupted connection or faulty storage.
- A file from a mirror or an unofficial link could have been modified to include malware.
A cryptographic hash changes completely if even one bit of the file changes, so a matching checksum is strong evidence the file is intact.
How to check
- Find the checksum on the publisher's official website, usually labelled SHA-256 (sometimes SHA-512 or, on older sites, MD5 or SHA-1).
- Drop your downloaded file into the File checksum calculator. It computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 locally — the file is not uploaded.
- Paste the published checksum into Expected checksum. The tool compares it with every algorithm and shows Match or No match.
What if it doesn't match?
Download the file again, preferably from the official site. If it still doesn't match, don't run it.
Which algorithm should I trust?
Prefer SHA-256 or stronger. MD5 and SHA-1 are still fine for detecting accidental corruption, but they are broken for security purposes: attackers can craft two different files with the same MD5.
Where does the checksum come from?
The checksum only helps if you get it from a trustworthy source — ideally the publisher's HTTPS website, and even better a digitally signed checksum file. A checksum listed on the same untrusted mirror as the download proves little.
Hashing text
To hash a piece of text rather than a file — for example to verify a webhook signature with HMAC-SHA256 — use the Hash generator.