How to Verify a File's Integrity with Checksums
A practical guide to using MD5, SHA-256 and SHA-512 checksums to confirm a downloaded file hasn't been corrupted or tampered with.
A checksum is a short fingerprint of a file produced by a hash function. To verify integrity, generate the checksum of your downloaded file and compare it to the value published by the source. If they match exactly, the file is intact.
When you download software, an ISO image, or a release archive, how do you know it arrived exactly as the author published it? A single flipped bit — from a bad network transfer or a malicious mirror — can matter. Checksums are the standard answer.
What is a checksum?
A checksum is the output of a hash function applied to a file. A hash function takes any amount of data and produces a fixed-length string. The same input always produces the same output, and even a one-byte change produces a completely different result.
Common algorithms you’ll see published next to downloads:
- MD5 — 128-bit, fast, but cryptographically broken. Fine for detecting accidental corruption, not for security.
- SHA-1 — 160-bit, also deprecated for security use.
- SHA-256 / SHA-512 — part of the SHA-2 family, the current standard for verifying authenticity.
Rule of thumb: for security, trust SHA-256 or SHA-512. For a quick “did this download corrupt?” check, any of them works.
How to verify a file, step by step
- Find the official checksum. Reputable projects publish it on the download
page or in a
SHA256SUMSfile next to the release. - Compute the checksum of your copy of the file.
- Compare the two strings. They must match character for character.
On the command line
On macOS or Linux:
shasum -a 256 ./downloaded-file.isoOn Windows PowerShell:
Get-FileHash .\downloaded-file.iso -Algorithm SHA256In your browser (no upload)
If you just have a string or small snippet to hash, you can use our Hash Calculator. It runs entirely in a Web Worker in your browser — nothing is uploaded — and shows MD5, SHA-1, SHA-256, SHA-384 and SHA-512 side by side.
What a mismatch means
If the checksums don’t match, do not run the file. Re-download it, ideally from a different official mirror, and verify again. A persistent mismatch can indicate corruption or a compromised download source.
Key takeaways
- Checksums verify integrity, not that a file is safe to run.
- Prefer SHA-256/SHA-512 for anything security-sensitive.
- Always compare against a checksum from a trusted, official source — a checksum hosted on the same compromised mirror proves nothing.
Was this article helpful?
Your reaction helps us write clearer, more practical security guides.
Security Editorial — plain-English guides and free, in-browser tools for hashing, passwords, encoding and safe downloads.