How to Verify a SHA-256 Checksum on Windows, Mac and Linux

The short answer

To verify a SHA-256 checksum, compute the file's hash on your computer and compare it with the value the publisher lists next to the download. If all 64 characters match, the file is identical to the publisher's. If they differ, delete the file and download it again from the official source.

Windows

Open Command Prompt in the download folder and run certutil -hashfile filename.iso SHA256. In PowerShell, run Get-FileHash .\filename.iso — SHA-256 is the default algorithm.

macOS

Open Terminal and run shasum -a 256 ~/Downloads/filename.dmg. Drag the file onto the Terminal window to paste its full path.

Linux

Run sha256sum filename.iso. If the publisher provides a SHA256SUMS file, run sha256sum -c SHA256SUMS in the same folder to check every listed file at once.

In your browser, without commands

Open the SHA-256 hash generator, choose Hash a file and select the download. The file is hashed locally and never uploaded. Paste the publisher's checksum into Compare: a green Match confirms it, and the tool also shows which algorithm matched if the publisher used SHA-1, SHA-384 or SHA-512.

Common reasons for a mismatch

• The download stopped early or was corrupted — compare the file size with the listed size.
• You compared against the checksum for a different version, architecture or mirror.
• The publisher lists SHA-512 or SHA-1, not SHA-256.
• You are hashing text rather than a file, and line endings (CRLF vs LF) or a trailing newline differ.

What a checksum does not prove

A matching hash shows the file equals what the checksum describes. It does not prove the publisher is trustworthy, and if an attacker controls the page that lists the checksum they can change both. Prefer checksums served over HTTPS from the vendor's own domain, and use signed releases (GPG or code signing) when they are offered.