How to Verify a SHA-256 Download Checksum on Windows, Mac and Linux

You download a software installer, operating-system image or large archive. The publisher also provides a long string labelled SHA-256. Is that string useful, and what do you do with it? A checksum comparison can help you determine whether the file you received has the same bytes as the file represented by the publisher’s reference digest. It is a quick integrity check that works without installing an unfamiliar app.

The important condition is that the expected checksum must come from a trustworthy source. If you download both the file and its checksum from the same compromised page, a match may tell you very little about whether the publisher intended that file. This guide explains the practical commands on Windows, macOS and Linux, plus the security limits that often get overlooked.

What SHA-256 actually measures

SHA-256 is a cryptographic hash function. It processes the bytes of a file and produces a 256-bit digest, commonly displayed as 64 hexadecimal characters. Changing the file’s bytes will ordinarily change that digest. The same exact file produces the same SHA-256 value on different computers, regardless of its filename or the folder in which it is stored.

A hash is not encryption, and it does not reveal the contents of the file. It is also not an antivirus scan or a code-signing certificate. A matching checksum is evidence of byte-for-byte correspondence with the referenced file; it does not independently establish that the file is safe, licensed correctly or free of vulnerabilities. Keep those distinctions clear when deciding whether to run an installer.

Step 1: obtain the expected digest safely

Go to the software publisher’s official download page, repository release page or documented mirror. Look for a SHA-256 value or a checksum manifest such as SHA256SUMS. Copy the value carefully and record the filename and version to which it applies. Some publishers provide separate digests for Windows, macOS, Linux, ARM and x86 builds. Comparing the correct checksum against the wrong architecture’s file will produce a mismatch even when neither file is corrupt.

Prefer a secure, independently verified source for the reference value. A checksum posted in an anonymous forum reply is not equivalent to one published by the software maintainer. For high-risk software, check a verified digital signature or the publisher’s release-signing instructions as well. A hash copied from an untrusted source can be replaced alongside the download.

Step 2: calculate SHA-256 on Windows with PowerShell

Open PowerShell. Navigate to the folder containing the download or supply its full path. Microsoft’s official Get-FileHash documentation confirms that SHA-256 is the default algorithm, but naming it explicitly makes your intent clearer. For example:

Get-FileHash -LiteralPath "$HOMEDownloadsexample.zip" -Algorithm SHA256

Replace example.zip with your actual filename. The output includes the algorithm, digest and path. Copy only the digest when comparing it with the publisher’s value. On a system using a different download directory, drag the file path into your terminal or use the file’s full location. Quotation marks help with spaces in filenames.

You can also run certutil -hashfile "example.zip" SHA256 from Command Prompt. The essential rule is the same: use SHA-256 if that is the algorithm the publisher specified. Do not compare an MD5 or SHA-1 result against a SHA-256 reference.

Step 3: calculate SHA-256 on a Mac

Open Terminal and run the built-in shasum command with the SHA-256 option:

shasum -a 256 ~/Downloads/example.zip

You can type the command followed by a space and drag the downloaded file into Terminal to insert its path. That reduces mistakes when a filename contains spaces or the file lives in an unfamiliar folder. The result prints a hexadecimal digest followed by the filename. Check that the file you hashed is the one you intend to install—not a similarly named older download left in the same folder.

If you are checking a disk image, compute the digest of the downloaded .dmg file before opening it. Extracting or repackaging an archive changes the bytes, so the checksum of an extracted folder will not match the digest of the original archive. The expected value applies to the specific published file.

Step 4: calculate SHA-256 on Linux

On most GNU/Linux systems, the standard sha256sum utility performs the same job. The GNU Coreutils manual documents how SHA-2 checksum commands print and check digests:

sha256sum ~/Downloads/example.zip

If the publisher supplies a checksum file in the expected format, you may be able to verify it with sha256sum -c SHA256SUMS from the directory containing the listed files. Read the manifest first: it can contain checksums for several platform builds that you did not download. A missing file warning is different from a digest mismatch. Do not edit the checksum manifest merely to make a failed comparison appear successful.

Step 5: compare the result exactly

A valid SHA-256 digest contains 64 hexadecimal characters. Compare the calculated value with the published value for the same filename and release. Uppercase and lowercase letters in the hexadecimal display represent the same value. Do not include spaces, filenames or a label such as SHA256: when comparing the digest itself. If you use a script to compare, ensure it is reading the expected value and the output you just calculated.

A successful match means your downloaded bytes match the bytes represented by the expected digest, assuming you trust that digest. A mismatch means you should stop before opening the file. Recheck the version and filename, then download again from the publisher. If the mismatch persists, contact the publisher or consult its official release notice. Do not bypass the warning because the installer appears to run normally.

Common reasons a correct download seems to fail

A checksum mismatch is not always an attack. You might have downloaded a different version, compared an ARM build with an x64 digest, copied only part of the hash, selected a file with a duplicate filename or hashed an extracted folder instead of the original archive. Browser download managers may also append a suffix to duplicate files, making it easy to choose the wrong one.

The right troubleshooting order is simple: verify the expected version, confirm the full file path, recalculate with the correct algorithm, and compare with the authoritative publisher reference. If the file is very large, wait for the download to finish before calculating the hash. Hashing a partially written file will not match the completed release.

Checksum versus digital signature versus malware scan

These tools answer different questions. A checksum asks whether the file matches a reference digest. A digital signature can provide evidence about who signed the file and whether the signed content changed, subject to certificate and trust-chain checks. A malware scanner searches for suspicious or known malicious behaviour or patterns. None is a universal guarantee of safety.

For an operating-system image or firmware file, a checksum is particularly useful because a corrupted download may fail during installation. For an unknown browser extension, the more relevant question may be the publisher’s identity and requested permissions; see NOWLIVO’s browser extension safety checklist. Different risks call for different checks.

A short verification workflow you can reuse

Before running a downloaded file, note its source and version, obtain the official SHA-256, compute your local digest, compare the complete values and preserve the result if the installation is important. If the publisher provides signature verification, follow that guidance too. This takes a few minutes and can prevent a corrupted archive from reaching a critical workflow.

For shared teams, document which exact artifact was approved. “We checked the installer” is vague; “we checked version X for platform Y against the digest published on the vendor release page on this date” is reproducible. Avoid copying private local file paths into public tickets if they reveal usernames or sensitive project names.

Frequently asked questions

Can I verify SHA-256 without installing software?

Yes. Windows PowerShell, macOS Terminal and most Linux distributions have suitable built-in commands.

Is a matching checksum proof that a file has no malware?

No. It shows correspondence to a reference digest. The publisher’s file could still be unsafe, and the reference itself could be untrustworthy.

Does renaming a file change its SHA-256 value?

No, not if the file’s contents remain identical. Recompressing or modifying its contents does change the bytes and usually the digest.

Why do I get a mismatch after extracting a ZIP?

You may be hashing a different object. Compare the publisher’s ZIP checksum with the original ZIP file, not the extracted contents.

Can I compare SHA-1 and SHA-256 values?

No. Use the same algorithm as the publisher. For security-sensitive integrity checks, prefer a current strong algorithm and the publisher’s documented procedure.

Source and refresh note: Command behaviour checked against Microsoft, GNU Coreutils and vendor checksum documentation on 2 November 2026. Verify current platform documentation if command defaults or release-signing procedures change.