How to Check a Download with a Checksum (Windows, Mac, Linux)

You download a Linux ISO, an installer, or a firmware file. Next to the download link there's a long string of letters and numbers labeled SHA-256. That string is a checksum. It's there so you can check that the file on your disk is the same file the publisher meant to send you.

The check takes about a minute.

What a checksum is

A hash function reads every byte of a file and boils it down to a short fixed-length fingerprint. Change one byte anywhere in the file and the fingerprint changes completely. Nobody can look at a SHA-256 value and work backwards to the file, but anybody can compute it again from the same file and get the same answer.

The publisher hashes the file on their side and posts the result. You hash your copy. If the two strings match, your copy is byte-for-byte identical to theirs.

Method 1: use the browser tool

1. Open the Hash Generator and switch to File mode.
2. Choose the file you downloaded. The tool reads it on your device, so a 4 GB ISO doesn't get uploaded anywhere.
3. Pick the algorithm the publisher used. It's almost always named right next to the checksum. If they list SHA-256, tick SHA-256.
4. Paste the publisher's checksum into the compare box, then click Generate. A match turns green. A mismatch turns red.

The comparison ignores upper and lower case, because hex digits mean the same thing either way. A591 and a591 are the same value.

Method 2: use your operating system

Every major OS ships with a hash command, so you don't need any extra software.

Swap SHA256 for SHA512, SHA1, or MD5 if that's what the publisher posted. Many Linux projects publish a whole file of checksums, usually named SHA256SUMS. In that case put the file next to your download and run:

sha256sum -c SHA256SUMS --ignore-missing

You'll see OK next to each file that matches and FAILED next to anything that doesn't.

What a mismatch means

Most of the time, a mismatch is boring. The download got cut off, your connection dropped a packet, or the file changed on the server and the page still shows the old hash. Try these before you panic:

• Download the file again and re-check. A flaky connection is the most common cause.
• Make sure you compared the right algorithm. A SHA-1 value won't ever match a SHA-256 result.
• Check for stray spaces or a missing character when you pasted the checksum.
• Look for a newer version of the file. If the publisher updated it, the old checksum is stale.

If a fresh download still fails and you've ruled out the items above, don't run the file. Ask the publisher or check their official channels.

What a matching checksum does not prove

A checksum only tells you your file matches the checksum you compared it to. If an attacker breaks into a website and swaps both the file and the checksum on the same page, you'll get a perfect match on a bad file.

Treat a checksum as protection against accidents. It does not stop a determined attacker who controls both the file and the posted hash. For tamper protection, look for one of these:

• A digital signature (for example a GPG .asc or .sig file) that you verify against the publisher's public key.
• A checksum posted on a different site or channel than the download itself.
• Installing through your OS package manager, which checks signatures for you.

Which algorithm should the publisher use?

SHA-256 is the sensible default today. MD5 and SHA-1 still catch accidental corruption fine, but researchers have shown practical ways to make two different files share the same MD5 or SHA-1 value. That makes them a poor choice when someone might be trying to fool you. Our MD5 vs SHA-256 guide goes into the details.