The quick way
A checksum is a fingerprint of a file. Change a single bit and the fingerprint changes completely, so matching values prove the two files are the same byte for byte. Publishers of operating system images, firmware, password managers, developer tools and drivers list checksums next to their downloads for exactly this purpose.
In the tool below, choose the file or drop it on the box. It calculates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once. Paste the published value into Compare with and the tool tells you which algorithm matches, or that none does. Capital letters, spaces and prefixes like sha256: are ignored. The file is read on your device and never uploaded.
Try it here: File Checksum Calculator
Open the full tool pageWhich algorithm is it? Tell by the length
Download pages do not always say which hash they list. The length of the hexadecimal string gives it away:
| Algorithm | Length in hex characters | Still safe against tampering? |
|---|---|---|
| MD5 | 32 | No, collisions are easy to create |
| SHA-1 | 40 | No, practical collisions shown in 2017 |
| SHA-256 | 64 | Yes, the current standard |
| SHA-384 | 96 | Yes |
| SHA-512 | 128 | Yes |
Where to find the checksum
The value usually sits right next to or below the download link, under a label such as SHA256, Checksum, Hash or Verify your download. Linux distributions publish a separate text file called SHA256SUMS with one hash and file name per line. Projects on GitHub often attach a checksums.txt file, or small files named after the download with .sha256 added, to the release page.
Firmware and driver pages sometimes give only an MD5 value, which is enough to catch accidental corruption. If you cannot find any checksum, look at the file's digital signature instead: on Windows, right click the file, choose Properties and open the Digital Signatures tab to see the publisher.
Verify a checksum on Windows, Mac and Linux
Every major system has a built in command. Open a terminal in the folder with the file and replace the file name with yours.
- Windows PowerShell: Get-FileHash .\file.iso shows the SHA-256 by default. Add -Algorithm MD5 or -Algorithm SHA512 for other hashes. PowerShell compares strings without regard to case, so you can also type (Get-FileHash .\file.iso).Hash -eq "expected value" and get True or False.
- Windows Command Prompt: certutil -hashfile file.iso SHA256. Replace SHA256 with MD5, SHA1 or SHA512 as needed.
- macOS Terminal: shasum -a 256 file.dmg for SHA-256, shasum -a 512 for SHA-512, and md5 file.dmg for MD5.
- Linux: sha256sum file.iso, sha512sum or md5sum. If the publisher provides a SHA256SUMS file, put it in the same folder and run sha256sum -c SHA256SUMS: each listed file shows OK or FAILED.
- Any system with a browser: the tool on this page, which helps on locked down work computers, Chromebooks and phones where you cannot open a terminal.
What a match proves, and what it does not
A match proves that your file is identical to the file the checksum was calculated from. That catches the most common problems: an interrupted download, a corrupted USB stick or SD card, a broken mirror server, or a proxy that changed the file.
It does not prove the file is trustworthy if the attacker controls both the file and the page that lists the checksum. If someone breaks into a download server, they can replace the file and the published hash together. That is why serious projects also sign their checksum files (for example a SHA256SUMS file with a matching .gpg signature) or sign the installer itself, which Windows shows as a verified publisher and macOS checks through notarization. For high value software, take the checksum from a different source than the file: the project's main website, its release notes or its official social account, rather than the mirror you downloaded from.
MD5 and SHA-1 are still fine for detecting accidental corruption, because random damage will not produce a collision. Against deliberate tampering, rely only on SHA-256 or stronger.
When the checksum does not match
- Check that you are comparing the same algorithm. A SHA-1 value will never match a SHA-256 result. The tool compares against all five hashes at once to rule this out.
- Make sure you have the right file. Download pages often list several builds (x64, ARM, installer, portable); each has its own checksum.
- Copy the full value. A checksum cut off by one character fails. Spaces and line breaks in the pasted value are ignored by the tool.
- Download again, ideally from the official source rather than a mirror, and with a stable connection. Incomplete downloads are the most common cause of a mismatch.
- Do not use the file if it still does not match after a fresh download from the official site. Report it to the publisher.
- If you hash text rather than a file, a trailing newline or a different text encoding changes the result. Checksums on download pages are always calculated from the file itself.
Large files and privacy
Some online checksum tools upload your file to a server. That is slow for a 4 GB disk image and a bad idea for private documents, backups or unreleased builds. The checker on this page reads the file directly from your disk in the browser; the SHA hashes are calculated by the browser's built in Web Crypto engine and nothing is sent anywhere.
Files of several hundred megabytes work on most computers and phones. Because the whole file is read into memory, very large images of several gigabytes can exceed what a browser tab may use; for those, the command line tools above are the better choice.