Verifying a Downloaded File with a Hash

Files can be corrupted in transit, or in rare cases altered somewhere between the publisher and you, such as on an unofficial mirror. Publishing a checksum alongside the download gives you a way to confirm your copy matches exactly what was published, without having to trust the download itself for that confirmation.

The check only means anything if the published hash comes from somewhere independent of the file you downloaded. A hash listed on the official project website is useful. A hash listed in the same email or forum post as a suspicious download link is not, since anyone forging the download could just as easily forge a matching hash next to it.

Every major operating system has a built in way to hash a file without installing anything extra.

shasum -a 256 downloaded-file.iso
# or, on most Linux systems
sha256sum downloaded-file.iso

Get-FileHash .\downloaded-file.iso -Algorithm SHA256

For plain text rather than a whole file, such as confirming a short snippet or license key matches what was issued, the Hash Generator on Frabs does the same job directly in your browser.

If the two hashes match exactly, your file is byte for byte identical to what the publisher intended you to have. If they do not match, something is different, but the check alone cannot tell you whether that is an incomplete download, a corrupted transfer, or genuine tampering. The correct response either way is the same: delete the file and download it again from the original source rather than trying to use a copy that failed verification.

Suppose a project's download page lists a SHA-256 checksum of a1b2c3 for their installer. You download the file, run sha256sum installer.exe in your terminal, and it prints a1b2c3 as well. That match confirms your copy is identical to the one the project published. If it printed something else entirely, that would be your signal to discard the file and fetch it again rather than proceeding.