What Is a Checksum, and How Do You Verify a File With One?

A checksum is a short string of letters and numbers that acts like a fingerprint for a file. If even one byte inside the file changes, the checksum changes completely, so you can compare the value published by the source against the value you compute on your own copy. Match means the file arrived intact. Mismatch means something altered it in transit.

What is a checksum?

Think of a checksum as a fingerprint that proves a file was not changed. You run the file through a fixed math function (a hash function), and out comes a fixed-length value like 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08. That value is the checksum, also called the hash value.

The same input always produces the same output. Download a 4 GB installer twice with no corruption, and both copies hash to the identical 64-character string. Flip a single bit, maybe a byte got mangled by a flaky network or a bad disk sector, and the result looks totally different. There is no partial match. This all-or-nothing behavior is exactly what makes it useful for checking file integrity.

Checksums are not encryption. They do not hide or lock the file, and you cannot reverse a checksum back into the original data. The job is narrow: confirm that the bytes you have are the bytes you were supposed to get. If you want the mechanics behind that math function, see how hashing actually works.

Checksum vs hash: are they the same thing?

In everyday use, yes. When a download page says “SHA-256 checksum” it means the SHA-256 hash of that file. People say “checksum,” “hash,” and “hash value” for the same 64-character string, and in practice they are interchangeable.

There is a small history behind the two words. “Checksum” originally meant simple error-detection codes like CRC32 or Adler-32, built to catch accidental corruption fast. “Hash” usually points to cryptographic functions like SHA-256 or the older MD5, which are stronger and harder to fool on purpose. Today most software downloads publish a cryptographic hash but still label it “checksum,” so you will see both words on the same page. Do not overthink it.

The distinction that does matter is which algorithm produced the value. A CRC32 checksum is 8 hex characters, MD5 is 32, SHA-1 is 40, SHA-256 is 64. If your computed value has a different length than the one published, you used the wrong algorithm, not the wrong file. For a closer look at why the older one fell out of favor, read SHA-256 vs MD5.

Why software downloads list a SHA-256 checksum

Two reasons: catching corruption, and catching tampering. A big download can get truncated, a mirror can serve a stale copy, and storage can rot over time. Publishing the SHA-256 hash next to the download link lets you verify the file yourself before you trust it.

The security angle is the bigger one. Say you download a Linux ISO from a mirror you have never heard of. How do you know the mirror did not slip malware into the image? You take the checksum the official project publishes on its own site (over HTTPS), compute the checksum of the file you got from the mirror, and compare. If they match, the mirror handed you the genuine file, byte for byte. Projects like Ubuntu, VeraCrypt, and most Linux distributions do exactly this.

This is why the source of the checksum matters as much as the value. A checksum listed on the same hacked page as a tampered download proves nothing, because an attacker who can swap the file can swap the checksum too. The published hash is only meaningful when it comes from a channel you trust more than the file itself.

How to verify a checksum on Windows, macOS, and Linux

The process is always the same. Compute the hash of your downloaded file, then compare it (character by character, or just paste both into a tool) against the published value. Here is the exact command for each system, using an example file called installer.iso and SHA-256.

Windows (certutil), built in, no install:

certutil -hashfile installer.iso SHA256

It prints the hash on its own line. For MD5, swap SHA256 for MD5. In PowerShell you can also use Get-FileHash installer.iso -Algorithm SHA256.

macOS (shasum), built in:

shasum -a 256 installer.iso

The -a 256 picks SHA-256. For MD5 on macOS, use the separate md5 installer.iso command.

Linux (shasum or sha256sum):

sha256sum installer.iso

Most distributions ship sha256sum, md5sum, and sha1sum out of the box.

Now compare. The published checksum and your output must match completely. A trick that beats squinting: copy your computed hash and the published hash into a text field and let the tool tell you if they are equal. Humans miss a single swapped character in a 64-digit string, which is the whole point of the next section.

What to do when the checksum doesn’t match

A mismatch means the file you have is not the file the source published. Do not run it. Work through the causes in order.

First, rule out the boring one: an incomplete or corrupted download. Re-download the file, ideally from a different mirror or over a more stable connection, and hash it again. Interrupted transfers are the most common reason by far.

Second, check that you compared the right algorithm. If the page lists a SHA-256 value (64 characters) and you ran md5, of course they differ. Match algorithm to algorithm.

Third, confirm you are looking at the checksum for that exact file and version. Projects publish separate hashes per file, and the value for installer-v2.1.iso will not match installer-v2.0.iso. If the download is complete, the algorithm is right, the version is right, and it still does not match, treat the file as untrustworthy and get it from the official source directly.

Checksums vs digital signatures: what integrity they actually prove

A checksum proves integrity: the file was not changed since the hash was made. It does not prove authenticity: who made the hash. Those are different guarantees, and mixing them up is where people get a false sense of safety.

Here is the gap. If an attacker replaces both the download and its published checksum on a compromised page, your comparison passes and you still get malware. The checksum only ever confirms that two things match, not that either one is legitimate. That is why the “get the checksum from a trusted channel” rule exists.

Digital signatures close that gap. A signature uses public-key cryptography, so the publisher signs the file with a private key only they hold, and you verify with their public key. That proves both integrity and authenticity, because no one without the private key can forge a valid signature, even if they control the download page. This is what GPG-signed releases and code-signing certificates give you. For accidental corruption a checksum is plenty. When the threat is a deliberate attacker, prefer a signature.

One more limit worth knowing: not every hash function is safe against a determined attacker. MD5 and SHA-1 have known collision attacks, meaning someone can craft two different files with the same hash on purpose. That does not affect catching random corruption, but it is why you should not trust MD5 for security. The details are in how hash collisions happen.

Verify a checksum yourself

You do not always need the command line. If you have a hash value and a piece of text (a config snippet, a token, a downloaded string) you can compute and compare the hash with no install. Our SHA-256 and MD5 hash generator gives you the value to compare against the one the source published. It is handy for spot-checking a string or teaching yourself how a single changed character rewrites the whole hash.

FAQ

Is a checksum the same as a hash? In practice, yes. Download pages use “checksum” and “hash” for the same value, usually a SHA-256 or MD5 result. The only real distinction is the algorithm that made it, which you can tell from the length: 32 characters for MD5, 40 for SHA-1, 64 for SHA-256.

Can two different files have the same checksum? With a strong function like SHA-256, no collision has ever been found, so treat it as no. With MD5 and SHA-1, yes: attackers can deliberately build two files that share a hash. That is why those older algorithms are fine for spotting accidental corruption but not for security.

What does it mean if the checksum doesn’t match? The file is not identical to the one the source published. Almost always it is an incomplete download, so re-download and check again. If it still fails after you confirm the algorithm and version, do not open the file.

Do I need special software to check a checksum? No. Windows has certutil, macOS has shasum, and Linux has sha256sum, all built in. You can also paste text into a browser-based hash generator and skip the terminal entirely.