The quick answer
Next to the download button there is a line such as sha256: ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. It is a fingerprint of the file the publisher built. Calculate the fingerprint of your copy, and if the two are the same, your copy is identical to theirs.
- Find the published hash and read its type from the label next to it. If there is no label, the length in hex characters is a good guide: 32 is usually MD5, 40 SHA-1, 64 SHA-256, 96 SHA-384 and 128 SHA-512.
- Open the hash generator, or start with a single algorithm on the SHA-256 or MD5 page. Choose File and drop the download on the box.
- Paste the published value into Compare with a hash. A whole line from
sha256sumworks, and so does a Base64 value. - Read the result: a green Match or a red No match.
A match means every byte of your copy is the same as the file that was hashed. A mismatch means download again, and if it still fails, do not run the file.
What a hash is, in plain words
A hash function turns any amount of data into a short fingerprint of fixed size. The same bytes always give the same fingerprint, and any change gives one that looks unrelated. The SHA-256 of hello starts 2cf24dba. Change one letter to hellp and it starts fdd7585e, and 63 of the 64 characters differ. Add a line break after hello and it starts 5891b5b5.
The algorithm decides the length, which is how you identify an unlabeled hash:
| Algorithm | Bits | Hex characters | Base64 characters |
|---|---|---|---|
| MD5 | 128 | 32 | 24 |
| SHA-1 | 160 | 40 | 28 |
| SHA-256 | 256 | 64 | 44 |
| SHA-384 | 384 | 96 | 64 |
| SHA-512 | 512 | 128 | 88 |
Capitals do not matter: BA78 and ba78 are the same value written two ways.
When a match protects you and when it does not
A hash is only as trustworthy as the place you got it from.
| Where the hash came from | What a match tells you |
|---|---|
| The same page and server as the download | Your copy is not damaged or cut short. It proves little against tampering, because someone who can replace the file can replace the hash beside it |
| A different trusted place, such as the publisher's own site while you downloaded from a mirror | The mirror's file matches what the publisher lists. This is where hashes help most |
| A signed checksum file | The strongest case, if you also check the signature |
| A forum post or message from someone else | Very little. Anyone can post a hash |
Even a match proves only that your file is the one that was hashed. If the publisher shipped something harmful, the hashes match. A hash checks integrity, not safety.
MD5, SHA-1 and SHA-256 compared
| Algorithm | Catches accidental damage | Safe against deliberate tampering | Use it |
|---|---|---|---|
| MD5 | Yes | No. Different inputs with the same MD5 can be made on purpose, a weakness found in 2004 | When it is all the site lists |
| SHA-1 | Yes | No. A practical collision was published in 2017 | When it is all the site lists |
| SHA-256, SHA-384, SHA-512 | Yes | Yes. No practical attack is known | Whenever you have the choice |
If a site lists both MD5 and SHA-256, check SHA-256. If it lists only MD5, a match still tells you the download arrived intact, which is the usual reason to check at all.
The same check on the command line
Run these in the folder that holds the file, or give the full path. They print the same value as the tool, so use one as a second opinion on a file that matters.
| System | SHA-256 | MD5 |
|---|---|---|
| macOS (Terminal) | shasum -a 256 file | md5 file |
| Linux | sha256sum file | md5sum file |
| Windows PowerShell | Get-FileHash file -Algorithm SHA256 | Get-FileHash file -Algorithm MD5 |
In an older Windows Command Prompt, certutil -hashfile file SHA256 does the job. PowerShell prints the hash in capitals, which is the same value as lowercase.
When it says No match
- Wrong algorithm. The page works out the type from the length. If you paste an MD5 value while MD5 is not ticked, it says so and asks you to tick it. After a file has been hashed, tick MD5 and then choose Hash again with the new selection.
- Wrong file. Hashes are published per file. The hash of an
.isodoes not match the.zipit came in, and a different version or processor build has its own hash. - Wrong mode. In Text mode the page hashes the characters you type, not a file. Pasting a file name there hashes the name.
- A cut-off or damaged download. Compare the size on disk with the size the site lists, then download again.
- A copy mistake. A wrong character in the pasted hash gives No match. A missing or extra one makes the page say it does not look like a hash. Copy the whole value.
- An edited file. Re-saving a text file can change its line endings (Windows uses two characters, Linux and macOS one), and that changes the hash.
If you download again from the official site and it still fails, treat the file as untrusted.
Hex, Base64 and big files
Some sites print a hash in Base64, where a SHA-256 is 44 characters and ends in =. Compare accepts hex or Base64, and the output can be switched between lowercase hex, capitals and Base64. Do not convert a hex hash by pasting it into the Base64 encoder. That encodes the 64 characters of text and returns 88 characters, not the 32 bytes the text stands for, which would be 44. Base64 encoding and decoding explained shows why.
Large files are fine. Files up to 256 MB are read at once so your browser can use its built-in SHA code, and bigger ones are read in 2 MB pieces so memory use stays small. The file is read from your disk into the page and is never sent anywhere, which you can confirm in the Network tab of your developer tools.
What hashes are not for
A hash is a fingerprint, not a way to hide or store a secret. The five algorithms here are built to be fast, so a leaked list of fast hashes can be guessed at enormous speed. Passwords need a slow, salted function, and the best protection is a long random password that is different for every account: make a strong password shows how long is long enough.