How to Verify a File Hash (and Why You Should Before Installing Anything)
I once downloaded a Linux ISO from a mirror site and skipped the hash check because I was in a hurry. The install failed halfway with cryptic errors, and I spent an evening debugging before re-downloading — this time checking the hash, which immediately showed the first file was corrupted. Thirty seconds of verification would have saved me an evening.
A file hash is a fingerprint: change even one byte of the file and the fingerprint changes completely. Developers publish the expected hash next to their downloads so you can confirm what you received is exactly what they shipped. Here's how to do the check properly.
What a file hash actually proves
A cryptographic hash function like SHA-256 takes any file — a 2 KB text file or a 4 GB disk image — and produces a fixed-length string of characters. The same file always produces the same hash; any alteration, however tiny, produces a wildly different one. When the hash you compute matches the hash the developer published, you know two things: the download wasn't corrupted in transit, and nobody tampered with it.
It does not prove the software itself is safe — a malicious developer's hash would match their malicious file. What it proves is integrity: the file is byte-for-byte what the publisher intended you to get.
How to check a hash in 30 seconds
- Find the expected hash on the developer's official download page (usually labeled SHA-256 checksum).
- Open our File Hash Verifier and select your downloaded file — it's read locally, never uploaded.
- Pick the same algorithm (usually SHA-256) and paste the expected hash into the compare box.
- Green match means you're good. Red mismatch means re-download from the official source.
Pro tip: copy the expected hash directly from the site rather than retyping it. Hashes are long, and one mistyped character gives a false mismatch.
SHA-256 vs SHA-512 vs MD5: which should you use?
Use whatever the developer published — that's the one you can compare against. If you get to choose, SHA-256 is the standard: fast, universally supported, and secure. And when you need to create a hash rather than check one, our SHA-256 Hash Generator does that locally too. SHA-512 is marginally stronger but produces a longer string; for file verification the difference is negligible.
Avoid MD5 and SHA-1 for security checks. Both are broken for collision resistance, meaning attackers can craft two different files with the same hash. They're fine for accidental-corruption checks, but never for verifying software you don't fully trust.
What to do when hashes don't match
Don't install it. A mismatch means the file differs from what the publisher released — most often a corrupted download, occasionally something worse. Delete the file, clear your browser cache, and download again from the official site (not a mirror). If the second download also mismatches, contact the developer: their published hash might be stale, or their site might be compromised.
I treat a hash mismatch like a smoke alarm: usually it's just toast burning, but you don't ignore it and go back to sleep.
Where to find official hashes — and the command-line shortcut
The expected hash should come from the same place you trust for the download: the developer's official download page, their release notes, or a signed checksum file (usually named SHA256SUMS or similar). Be wary of hashes posted in forums, comments, or third-party mirrors — if the mirror is compromised, its posted hash may be too. When a project signs its checksum file, verifying the signature is the gold standard, because it ties the hash back to the developer's key.
You can also check a hash without any tool at all. On Windows, run certutil -hashfile filename SHA256 in a terminal. On macOS or Linux, run shasum -a 256 filename (or sha256sum filename on Linux). The output should match the published hash character for character — compare it in chunks of eight characters rather than eyeballing the whole string, because a single differing character in the middle is easy to miss.
The browser route is faster for most people, though: drop the file into our File Hash Verifier, paste the expected hash, and you get a green or red answer in seconds, with nothing uploaded. And if you ever need to publish a hash for a file you created, our SHA-256 Hash Generator produces it locally in the same way.