Guide
How to Verify a File Download with a Checksum
Use SHA-256 hashes to compare a downloaded file against a trusted checksum before opening or distributing it.
Last updated: 2026-07-23
Get the checksum from a trusted source
A checksum is only useful when the reference value comes from the real publisher, project release page, or another trusted distribution channel. A matching hash copied from an untrusted mirror does not prove the file is safe.
Use the same algorithm
SHA-256, SHA-384, SHA-512, SHA-1, and MD5 produce different strings. Confirm the algorithm label before comparing values. For modern integrity checks, prefer SHA-256 or stronger when the publisher provides it.
Hash the file bytes
If the published checksum is for a file, hash the downloaded file itself. Copying the file contents into a text box can change encoding, line endings, or hidden bytes and produce a different digest.
Compare the whole value
A cryptographic hash is designed so a tiny input change creates a very different output. Compare every character, not only the beginning or end of the string.
Know what a match means
A matching checksum confirms that your file matches the published value. It does not prove the software is harmless, that the publisher is trustworthy, or that the download should be allowed by your organization.
Regenerate after changes
If a file is edited, recompressed, unzipped and zipped again, or downloaded a second time, generate a new hash. The old checksum applies only to the exact original bytes.