Check a Download Before You Run It: Verify Its SHA-256 Hash

You downloaded an installer or a disk image. Before opening it, there is one useful check you can make: compare its SHA-256 hash with the value published by the software vendor.

A hash is a fingerprint calculated from a file’s contents. This check can catch an incomplete download or a file that differs from the publisher’s copy. It does not run the downloaded program.

The important limit: a matching hash does not prove that software is safe. A malicious website can offer a harmful file and its matching checksum. Start with a vendor you trust, and do not run unknown files just because their hashes match.

Before you start

• A fully downloaded file that you have not opened or installed.
• The vendor’s SHA-256 value for that exact version, operating system and architecture.
• Windows PowerShell 5.1 or PowerShell 7 on Windows; Terminal with shasum on macOS; or a Linux terminal with GNU sha256sum.

No administrator account is needed to read a file you already have permission to access. If a command is missing, stop and check your operating system’s official documentation rather than downloading a random “hash checker.”

1. Get the expected hash from the right place

Navigate independently to the genuine vendor’s HTTPS website using a known address or trusted bookmark. Find its download verification or release page. Check the domain carefully: HTTPS alone does not establish that a site belongs to the real vendor.

Copy the SHA-256 value for your exact download into a plain-text note. It should contain 64 hexadecimal characters: the digits 0–9 and letters a–f. Uppercase letters are fine too. Do not substitute an MD5 or SHA-1 value, or use a checksum pasted by an unknown commenter.

If the vendor publishes a digitally signed checksum list, follow its signature-verification instructions as well. A signature verified against the publisher’s trusted key adds evidence of origin that a bare checksum cannot provide. This tutorial only covers comparing one file’s hash.

2. Calculate your file’s hash

Choose only the command for your operating system. Replace the example path with the full path to your downloaded file, including its extension. Keep paths quoted so spaces do not split them into separate arguments. The paths below are placeholders, not files to download.

Windows: PowerShell

Open PowerShell, not Command Prompt, and enter:

(Get-FileHash -Algorithm SHA256 -LiteralPath 'C:\Users\YOUR_NAME\Downloads\download.zip').Hash

The -LiteralPath option prevents brackets in filenames from being treated as wildcards. The command prints the hash on its own.

macOS: Terminal

Open Terminal and enter:

shasum -a 256 '/Users/YOUR_NAME/Downloads/download.zip'

Keep -a 256: plain shasum uses SHA-1 by default. The first field of the output is the hash; the filename follows it.

Linux: Terminal

Open your terminal and enter:

sha256sum -- '/home/YOUR_NAME/Downloads/download.zip'

The first field is the hash. The -- marks the end of command options. This reads only the file you name; you do not need to feed a downloaded checksum list into a command.

3. Compare all 64 characters

Compare the calculated hash with the expected value you saved in step 1. Ignore letter case, but check the whole value, not just its beginning and end. The filename printed after a hash is not part of the hash.

• Match: the file passed this integrity check against the value you obtained. Keep normal operating-system protections enabled and evaluate whether you trust the publisher before installing anything.
• Mismatch: stop. Do not open the file or bypass a security warning. Recheck the release, architecture and filename. If those are correct, download a fresh copy from the genuine vendor and check again. If it still differs, ask the vendor through its official support channel.

If something looks wrong

• “File not found”: check the folder, extension and whether your browser added a suffix such as (1). Use the actual path, not the placeholder.
• A filename contains an apostrophe: simple single-quoted examples need special handling. In PowerShell, double an apostrophe inside a single-quoted path. In macOS or Linux shells, use filename tab completion to obtain an escaped path rather than guessing the quoting.
• No output yet: large files take longer. Wait for the command to finish before comparing.
• The vendor has no SHA-256 value: calculating one yourself provides no independent value to compare with. Look for the vendor’s documented signature-verification method instead.

What was tested

The Linux command was tested with GNU coreutils 9.7 on Linux x86-64. A harmless text fixture with spaces and brackets in its filename produced the same hash as Python 3.12.14’s hashlib. Inserting one byte changed the result, and both tools agreed again.

The Windows command was checked against Microsoft’s Windows PowerShell 5.1 documentation, and the macOS command against the upstream shasum documentation. Neither was executed on Windows or macOS for this article.

Cleanup: these hash commands do not modify your download or create a verification file. Nothing needs deleting afterward.

Sources and further reading

• Microsoft Learn: Get-FileHash (Windows PowerShell 5.1)
• GNU Coreutils manual: SHA-2 utilities
• Perl documentation: shasum
• Ubuntu: verifying download integrity and authenticity