How to Verify a File's Checksum Before You Trust a Download
A publisher posting a SHA-256 checksum next to a download link is telling you exactly how to check the file wasn't corrupted or tampered with — here's how to actually use it.
TCTechToolsCenter TeamSoftware publishers, especially for things like OS images, installers and release archives, often post a checksum — a string like `a3f5c9...` — right next to the download link. Most people skip past it. It exists for a specific reason: it's the only reliable way to confirm the file that landed on your disk is bit-for-bit identical to the one the publisher actually built.
What a checksum actually proves
A hash function like SHA-256 takes a file's contents and produces a fixed-length string. The property that matters here: changing even a single byte of the file — a corrupted download, a tampered installer, a mirror serving the wrong version — produces a completely different hash, not a similar one. If your computed hash matches the publisher's exactly, the file is confirmed identical to what they built. If it doesn't match, even by one character, something is different, and you shouldn't run it.
Sponsored
Where to find the official checksum
Reputable publishers post the checksum on the same page as the download, in release notes, or in a separate checksum/signature file next to the download link. If a download page doesn't publish one at all, you simply can't verify that download this way — that's worth noticing, especially for anything you're about to run with elevated permissions.
Step-by-step: verifying a download
- Open the Hash Generator and switch to File checksum mode.
- Drop in the file you downloaded.
- Pick the algorithm the publisher used — almost always SHA-256 today; occasionally SHA-1 or SHA-512 for older or larger releases.
- Paste the checksum the publisher published into the "expected checksum" field.
- Check the match/mismatch result the tool shows you.
If the checksums don't match
Don't run the file. A mismatch usually means an incomplete or corrupted download — re-downloading, ideally from a different mirror, fixes this most of the time. Less commonly, it can mean the file was altered somewhere between the publisher and you. Either way, the fix is the same: get the file again from the official source and re-verify, rather than assuming it's probably fine.
A checksum only proves integrity, not trustworthiness
It's worth being precise about what a matching hash actually tells you: the file matches what the publisher intended to distribute. It does not tell you that publisher is trustworthy, or that the software itself is safe — that's a separate judgment. A checksum protects against corruption and tampering in transit; it doesn't vouch for the software's author.
Tools used in this article
Sponsored
Frequently asked questions
Whichever one the publisher posted — check their download page or release notes. If they offer a choice, SHA-256 is the current standard; avoid MD5 if a stronger option is available, since MD5 has known collision weaknesses.
TechToolsCenter Team
Product & Tools
The team behind TechToolsCenter — building fast, private, browser-based tools and writing practical guides on how to get the most out of them.
Related articles
MD5 vs SHA-256: What's the Difference and Which Should You Use?
Both turn data into a fixed-length fingerprint, but MD5 is broken for anything security-sensitive while SHA-256 isn't — here's what that actually means in practice.
How Random Number Generators Actually Work (And Why It Matters for Passwords)
Not all "random" is equally random — Math.random() and crypto.getRandomValues() look similar but are built for completely different jobs.
HTTP vs HTTPS: Why That One Letter Matters
The 's' in HTTPS stands for a real, meaningful difference in how your data travels across the internet — here's what it actually protects.