How to Verify a SHA-256 Checksum on Windows, macOS and Linux

When you download an operating-system image, installer, archive or software package, the publisher may provide a SHA-256 checksum beside the download. You can calculate the checksum of your copy and compare the two values to check whether the file’s contents match the publisher’s published value. You do not need a paid utility: Windows, macOS and Linux all have free command-line options.

This guide shows how to calculate and verify a SHA-256 file checksum on Windows, macOS and Linux, including commands that compare the result automatically. It also explains what a match does—and does not—prove.

What is a SHA-256 checksum?

A cryptographic hash function processes data and produces a fixed-length digest. SHA-256 is part of the SHA-2 family and produces a 256-bit digest, normally displayed as 64 hexadecimal characters. A change to the file’s contents produces a different digest in ordinary use.

File names and extensions are not part of the calculation. Renaming or moving a file does not change its hash; changing its contents does. SHA-256 is commonly used to compare downloaded files with values published by software projects and operating-system distributors. The Secure Hash Standard is documented by the National Institute of Standards and Technology (NIST).

Before you verify a checksum

First, find the expected checksum on the software publisher’s official download page, release page or authenticated distribution channel. Check that it belongs to the exact version and file you downloaded. A checksum for a different installer, architecture or release will not match.

• Confirm the algorithm named by the publisher. Use SHA-256 only when the published value is SHA-256; some projects publish SHA-512 or another digest.
• Copy the complete expected value. A SHA-256 digest normally contains 64 hexadecimal characters.
• Keep the downloaded file unchanged while calculating its hash.
• Prefer a checksum delivered through a trusted channel separate from the file download. If an attacker can replace both the file and the checksum, a matching value alone cannot establish who published the file.

1. Verify a SHA-256 checksum on Windows

Option A: Use PowerShell (recommended)

PowerShell includes the Get-FileHash cmdlet. Microsoft documents SHA256 as its default algorithm; specifying it explicitly makes the command easier to read and review.

Open PowerShell and run this command, replacing the example path with the location of your downloaded file:

Get-FileHash -LiteralPath 'C:\Users\YourName\Downloads\installer.exe' -Algorithm SHA256

The output includes the algorithm, hash and file path. Compare the value in the Hash field with the SHA-256 value supplied by the publisher. The path is quoted so it also works when folders or file names contain spaces. See Microsoft’s Get-FileHash reference.

To compare the values automatically, paste the publisher’s 64-character checksum into the variable below:

$File = 'C:\Users\YourName\Downloads\installer.exe'
$Expected = 'PASTE_THE_PUBLISHERS_SHA256_VALUE'
$Expected = $Expected.Trim()
$Actual = (Get-FileHash -LiteralPath $File -Algorithm SHA256).Hash

if ($Actual -ieq $Expected) {
    'MATCH: The calculated SHA-256 value matches.'
} else {
    'MISMATCH: Do not run the file until you investigate.'
}

The comparison is case-insensitive because hexadecimal letters may be displayed in uppercase or lowercase. It does not ignore missing or extra characters, so copy the full value carefully.

Option B: Use Command Prompt with CertUtil

If you prefer Command Prompt, Windows includes the certutil utility. Open Command Prompt and run:

certutil -hashfile "C:\Users\YourName\Downloads\installer.exe" SHA256

CertUtil prints the calculated digest. Compare it with the publisher’s SHA-256 value. This option calculates the hash; PowerShell is more convenient when you want a script to return a clear match or mismatch result.

Microsoft’s reference documents the -hashfile option and cautions that CertUtil is not recommended for production code. For repeatable scripts, prefer PowerShell’s Get-FileHash cmdlet. Read Microsoft’s CertUtil reference.

2. Verify a SHA-256 checksum on macOS

Open Terminal from Applications > Utilities. Use the shasum command with the -a 256 option to calculate the SHA-256 digest:

shasum -a 256 "$HOME/Downloads/installer.dmg"

Terminal displays the digest followed by the file path. Compare the digest with the value published for that exact download. You can also ask shasum to check a supplied checksum automatically. Replace the placeholder below with the publisher’s value and use the same file name and path:

EXPECTED='PASTE_THE_PUBLISHERS_SHA256_VALUE'
printf '%s  %s\n' "$EXPECTED" "$HOME/Downloads/installer.dmg" | shasum -a 256 -c -

A successful comparison reports OK; a mismatch is reported as a failure. If shasum is not available in your environment, and OpenSSL is installed, you can calculate the digest with:

openssl dgst -sha256 "$HOME/Downloads/installer.dmg"

The OpenSSL command prints a digest for the file. Compare the hexadecimal value with the trusted published checksum. The OpenSSL dgst documentation describes the digest command and its options.

3. Verify a SHA-256 checksum on Linux

On GNU/Linux distributions that include GNU Coreutils, use sha256sum. Open a terminal and run:

sha256sum "$HOME/Downloads/installer.iso"

The command prints the SHA-256 digest and the file name. To compare it automatically with the publisher’s value, use:

EXPECTED='PASTE_THE_PUBLISHERS_SHA256_VALUE'
FILE="$HOME/Downloads/installer.iso"
printf '%s  %s\n' "$EXPECTED" "$FILE" | sha256sum --check -

If the values match, the command reports that the file is OK. If it reports a failure, the calculated digest does not match the expected value. The GNU Coreutils manual documents sha256sum and the other SHA-2 utilities.

If sha256sum is not installed, check whether your distribution provides it through its standard Coreutils package. If OpenSSL is already available, this alternative calculates the digest:

openssl dgst -sha256 "$HOME/Downloads/installer.iso"

What does a matching or mismatching checksum mean?

Match: The file you checked has the same contents as the file represented by the expected digest, assuming both values use the same algorithm. This is useful for detecting an incomplete, corrupted or altered download.

Mismatch: The contents do not match the expected value. Check that you selected the correct file and version, copied the full checksum, and used the algorithm named by the publisher. If the result still differs, do not install or open the file. Download it again from the publisher’s official source and check once more. If it continues to fail, follow the publisher’s security or support guidance.

Checksum vs digital signature: an important security difference

A checksum is a useful way to compare file contents, but it does not by itself prove who created the file. If a malicious party can replace both a download and the checksum displayed beside it, the two may still match.

A digital signature can provide evidence that a file or release was signed by the holder of a particular signing key. When a publisher provides a signature, verify it using the publisher’s official instructions and a trusted public key or fingerprint. Do not treat a checksum and a digital signature as interchangeable.

For security-sensitive downloads, use SHA-256 or another algorithm specified by the publisher and avoid relying on MD5 or SHA-1 as protection against deliberate tampering. Microsoft notes that MD5 and SHA-1 are no longer considered secure for this purpose in its Get-FileHash documentation.

Common checksum verification mistakes

• Using the wrong algorithm: A SHA-512 value will not match a SHA-256 calculation. Follow the algorithm named by the publisher.
• Checking the wrong release: Make sure the checksum belongs to the same version, architecture and file format.
• Copying an incomplete value: Recheck all 64 hexadecimal characters for SHA-256.
• Checking a different file: Verify the downloaded installer or archive itself, not a renamed, extracted or modified copy.
• Trusting an unverified checksum source: Prefer the official project site or a separately authenticated release channel.
• Assuming a match proves safety: A matching checksum does not replace antivirus checks, publisher signature verification or sensible download practices.

Frequently asked questions

1. How many characters are in a SHA-256 checksum?

A SHA-256 digest is 256 bits long and is normally displayed as 64 hexadecimal characters.

2. Does renaming a file change its SHA-256 hash?

No. The hash is calculated from the file’s contents, not its name or extension. Moving or renaming an unchanged file does not alter its digest.

3. Is SHA-256 encryption?

No. Hashing is a one-way calculation that produces a digest; it does not encrypt a file or provide a way to recover the original contents from the digest.

4. Is a matching checksum proof that a download is safe?

Not by itself. It shows that the file matches the expected digest. You still need to trust the source of that digest. For stronger publisher authentication, verify a digital signature when one is provided.

5. What should I do if the checksum does not match?

Do not run the file. Confirm the algorithm and release, copy the expected value again, and download a fresh copy from the official publisher. If the mismatch remains, contact the publisher or follow its security guidance.

Conclusion

Checking a SHA-256 checksum is a simple, free way to compare a downloaded file with a publisher’s expected value. Use PowerShell or CertUtil on Windows, shasum on macOS, or sha256sum on GNU/Linux. Most importantly, obtain the expected checksum from a source you trust and remember that a matching hash is an integrity check—not a substitute for verifying a publisher’s digital signature.

Official references

• NIST: Secure Hash Standard
• Microsoft Learn: Get-FileHash
• Microsoft Learn: CertUtil
• GNU Coreutils: SHA-2 utilities
• OpenSSL: dgst command