How to Verify SHA-256 Checksums on Windows, Mac, and Linux

Guides & Tutorials / Download verification / Windows, Mac & Linux

To verify a download’s SHA-256 checksum, get the expected value from the publisher, calculate the downloaded file’s SHA-256 hash, and compare the entire result. Use PowerShell on Windows, shasum -a 256 on macOS, or sha256sum on Linux.

This check is useful for operating-system images, installers, archives, and other files distributed with published checksums. It helps answer a specific question: does this file match the reference I intended to download? The reliability of that answer depends on where you obtained the reference.

01 / Understand what SHA-256 checks

A cryptographic hash turns a file’s contents into a fixed-length digest. NIST’s hash-function overview identifies SHA-256 as part of the SHA-2 family and describes the resistance properties expected of approved hash functions.

SHA-256 produces a 256-bit result, commonly displayed as 64 hexadecimal characters: digits 0–9 and letters a–f. A matching result is strong evidence that the file’s contents match the referenced contents. Hashing is not encryption, and calculating a hash does not inspect what a program will do when it runs.

Keep those questions separate. A perfectly downloaded file can still be the wrong build for your machine or come from an untrustworthy distributor.

02 / Find the checksum for the exact download

Start at the developer’s official website or its officially linked release repository. Look for a field labelled SHA-256, a checksum text file, or release-verification instructions. Do not substitute a checksum posted in an unrelated comment, advertisement, or unofficial download directory.

• Match the release number, including any patch version.
• Match the operating system and architecture, such as x64 or ARM64.
• Match the package type: an installer, portable archive, and disk image are different files.
• If a checksum list contains several entries, select the exact filename you downloaded.

Hypothetical example: a vendor offers ExampleApp-4.2-x64.zip and ExampleApp-4.2-arm64.zip. Use the entry for your downloaded archive. A mismatch against the other architecture’s entry does not establish that either file was corrupted.

When the publisher supplies signed checksums

A checksum list can itself be replaced. If the publisher documents signature verification, follow that process and establish the expected signing-key identity. Canonical’s Ubuntu cloud-image guide, for example, separates authentication of its checksum file from comparison of the image against that file.

Downloading a file and an unsigned checksum from the same compromised source would not resolve that source’s trust problem. A signature check helps only when you have established whose key you are trusting. Use the publisher’s current instructions rather than importing an arbitrary key because its display name looks familiar.

03 / Calculate SHA-256 on Windows with PowerShell

Open Windows PowerShell from Start, or select a PowerShell tab in Windows Terminal. Terminal can host different shells; a Command Prompt tab is not the same as PowerShell. Microsoft explains the relationship between these console apps and Windows Terminal.

Run the following command after replacing the example path with your file’s full path:

Get-FileHash -LiteralPath 'C:\Users\YourName\Downloads\installer.zip' -Algorithm SHA256 | Format-List

Read the Hash field and confirm that Algorithm says SHA256. Microsoft’s Get-FileHash documentation describes this command and the LiteralPath parameter, which avoids treating filename characters as wildcards.

Keep ordinary straight quotation marks around the path, particularly when it contains spaces. Use a file your account can read; hashing a normal download does not require running the installer or changing PowerShell execution policy.

If PowerShell reports that the file does not exist, correct the path before proceeding. A missing-file error is not a checksum mismatch.

04 / Calculate SHA-256 on a Mac with Terminal

Open Terminal and enter the following, substituting the actual location and filename:

shasum -a 256 "/Users/you/Downloads/installer.dmg"

You can also type shasum -a 256 , including the trailing space, then drag the downloaded file from Finder into Terminal and press Return. Apple documents this method for calculating a package hash.

The output includes the digest and the filename. Compare the digest with the publisher’s SHA-256 value. The filename printed beside it is not part of the hash.

Keep -a 256 in the command. The shasum manual documents its algorithm selector and lists SHA-1 as the default. Running a different algorithm will not produce the publisher’s SHA-256 result.

If your system reports that shasum is unavailable, check the publisher’s supported verification method for that environment. Avoid installing an unknown “checksum repair” application to deal with a simple command error.

05 / Calculate SHA-256 on Linux

In a terminal, use the full path to the downloaded file:

sha256sum "/home/you/Downloads/installer.iso"

The GNU Coreutils manual documents sha256sum among its SHA-2 checksum utilities. Read the digest at the start of the output, followed by the filename.

If you prefer to run the command from the download folder, open a terminal there and use a relative path:

sha256sum "./installer.iso"

The ./ indicates the current directory. Replace the example name with the file you actually have, preserving its extension. Quotation marks keep a path containing spaces together as one argument.

If the command is unavailable on a minimal installation, consult your distribution’s documentation for its checksum utility or Coreutils package. Use your normal account for a readable downloaded file; changing permissions or adding sudo is not a substitute for selecting the correct path.

06 / Compare all 64 hexadecimal characters

Check the entire digest. Matching the first or last few characters is not a full verification. Uppercase and lowercase hexadecimal letters represent the same values, so a display using capital A–F can match one using lowercase a–f.

Separate the digest from surrounding labels, spaces, and filenames. A wrapped line on a narrow screen does not necessarily mean the value is incomplete. Copy the full digest into a local text editor alongside the expected value if that makes comparison easier.

Before accepting a match, confirm these three items together:

1. The reference is labelled SHA-256, and your command used SHA-256.
2. The reference belongs to the exact release file you intended to obtain.
3. The full hexadecimal values match.

If an AI assistant supplied the expected hash, retrieve it from the publisher yourself. Our guide to verifying AI-generated citations explains the same underlying research habit: open the original source and check that it supports the supplied information.

07 / Investigate a mismatch before using the file

A mismatch means your calculated digest differs from the reference you selected. It does not, by itself, identify the cause. Do not run a suspicious download simply to see whether it works.

Record the release, filename, source URL, expected digest, and calculated digest when reporting a persistent issue. That gives support useful evidence without assuming an attack occurred.

If the values match, continue with the publisher’s installation instructions and your operating system’s normal security checks. A successful checksum comparison does not justify bypassing a separate security warning.

Frequently asked questions