How to Verify Software Downloads with SHA-256 Checksums on Windows, Mac, and Linux

Overview

A checksum is a short representation of a file’s contents. When you calculate a SHA-256 checksum, your operating system processes the entire file and produces a hexadecimal string. If even a small part of the file changes, the resulting value should change as well.

Checksum verification is useful for installers, portable applications, disk images, developer tools, creator software, and large archives. It can help identify an incomplete download, a damaged file, or a file that differs from the version referenced by the publisher. It is one part of a safe software download process, not a substitute for choosing a trustworthy source.

Before downloading, start from the software publisher’s official website or a download page that clearly identifies the publisher and release. Look for a SHA-256 value in the release notes, download documentation, a checksums file, or a clearly associated verification page. A checksum copied from an unrelated forum or an unverified mirror is not a reliable reference.

For broader source-checking guidance, see how to tell if a download link is official, safe, or fake. If you are deciding between file types, the guides to offline installers and web installers and portable versus installer apps provide useful context.

Checklist by scenario

Before downloading

1. Identify the exact product, version, operating system, processor architecture, and file type you need.
2. Open the official download page or a mirror explicitly linked by the publisher. Be cautious when a search result leads to a lookalike domain, an unsolicited download, or an installer with a different filename.
3. Record the expected filename and the published SHA-256 value. Check whether the page lists separate values for Windows, Mac, Linux, ARM, or x64 builds.
4. Download the file completely. If the download manager reports an error or resumes repeatedly, download it again before checking the checksum. A download manager can be useful for large files; see download managers with mirror and resume support.

Windows checksum verification

Windows includes a command-line utility that works without installing another program. Open Command Prompt, change the path and filename in the example, and run:

certutil -hashfile "C:\Users\YourName\Downloads\setup.exe" SHA256

The command returns the SHA-256 value and the filename. Compare the value character by character with the publisher’s reference. In PowerShell, you can use:

Get-FileHash "C:\Users\YourName\Downloads\setup.exe" -Algorithm SHA256

PowerShell displays the hash in a table. You can also right-click the file and copy its path in supported versions of Windows, then place that path between quotation marks. Quotation marks matter when a filename or folder contains spaces.

Mac checksum verification

Open Terminal and use shasum with the SHA-256 option:

shasum -a 256 ~/Downloads/Installer.dmg

You can drag the downloaded file into the Terminal window after typing shasum -a 256 ; macOS inserts the correct path. This is helpful when the filename contains spaces or unusual characters.

Linux checksum verification

Most Linux distributions include sha256sum. From a terminal, run:

sha256sum ~/Downloads/package.tar.gz

If the publisher provides a checksum file in the standard format, you may be able to verify it directly after placing both files in the same directory:

sha256sum -c SHA256SUMS

Read the output carefully. A result such as “OK” means the calculated value matches the value in that checksum file. It does not independently prove that the checksum file came from the publisher, so obtain that file from a trusted official location.

When using a download mirror

A mirror can improve download speed or availability, but treat it as a delivery location rather than the authority for the file. Compare the downloaded file’s SHA-256 value with the value published by the software project or publisher. If a mirror lists a different checksum, pause and investigate instead of choosing whichever value produces a match.

What to double-check

• Algorithm: Confirm that you are comparing SHA-256 with SHA-256. Do not compare a SHA-256 result with an MD5 or SHA-1 value.
• Exact file: Check the filename, extension, version, architecture, and package format. A Windows installer and a portable archive for the same release will normally have different checksums.
• Complete value: A SHA-256 checksum contains 64 hexadecimal characters. Avoid copying a truncated value or one with an omitted character.
• Trusted reference: Verify that the published checksum comes from the official download page, release documentation, or a project-controlled channel.
• Signature verification: For software that provides a digital signature, use it when practical. A checksum confirms file equality with the reference; a cryptographic signature can also help establish who signed that reference.
• File location: Make sure your command points to the file you actually intend to install. Similar filenames in a Downloads folder can cause an accidental check of the wrong file.

If the checksum matches, continue with your normal installation checks, such as reviewing the installer’s publisher information and confirming that the operating system reports no unexpected warning. If it does not match, do not install the file until you understand why.

Common mistakes

Checking the wrong algorithm: MD5 is still encountered in older documentation, but SHA-256 is the better default when both are available. Do not treat an MD5 match as equivalent to a SHA-256 verification.

Comparing visually similar values: Long hexadecimal strings are easy to misread. Paste both values into a text editor or use a comparison tool, then check that the strings are identical. Do not ignore a difference because it appears near the end.

Using a stale checksum: A checksum belongs to one exact file. If you download a newer release, a regional build, or a different architecture, retrieve the corresponding checksum instead of reusing an older one.

Assuming a matching checksum proves the website is safe: The check only tells you that your file matches the reference value you selected. If the reference came from a compromised or impersonated page, the result does not establish authenticity. Always assess the official download link and the source of the checksum together.

Ignoring incomplete downloads: A browser may leave a partial file with a temporary extension, or a network failure may produce a file that looks complete. Finish or restart the download, then calculate the checksum again.

For a more detailed comparison of SHA-256 and MD5 workflows, keep this checksum verification guide available as a companion reference.

When to revisit

Revisit this checklist whenever you download a new software release, switch operating systems, choose a different mirror, or replace an installer in an automated deployment folder. It is especially useful before seasonal planning cycles, workstation refreshes, lab rebuilds, and production rollouts, when a file downloaded months ago may no longer be the intended version.

Update your internal notes when a project changes its release page, checksum format, filename convention, or package layout. If your workflow changes from installer packages to portable archives, document the new expected filenames and verification commands. For recurring deployments, keep the verified checksum beside the approved version and record the source URL and download date.

Before acting, use this final sequence: start at a trusted official download link; select the exact package; save its published SHA-256 value; calculate the checksum locally; compare every character; and stop if the values differ. Only after those checks should you proceed with the install tutorial or deployment process. This small routine makes a direct download easier to audit and reduces avoidable installer issues across Windows, Mac, and Linux.