Verify a Download Checksum: What a Match Does and Does Not Prove
The check
Hash the file you downloaded and compare it to the checksum the publisher gives. Either use the file hash page (paste the published value into its field and it names the matching algorithm) or the command line:
sha256sum file # Linux
shasum -a 256 file # macOS
certutil -hashfile file SHA256 # WindowsThe hash comparison page compares two pasted digests ignoring case, spaces and colons, and tells you when they cannot be the same algorithm because their lengths differ (32 hex digits is MD5, 40 SHA-1, 64 SHA-256, 128 SHA-512).
Why a correct file can fail
| Cause | Check |
|---|---|
| The checksum is for a different algorithm | Compare lengths; the comparison tool names each side's algorithm |
| The file was altered in transit by a proxy, or the download was incomplete | Compare the file size, then download again |
The checksum covers a different file (the .tar.gz versus the .zip) | Check the filename next to the checksum |
| You hashed text instead of the file | Hash the file bytes, not a pasted copy |
What a match proves
That your copy is byte-for-byte the file the checksum was computed from. It does not prove the publisher is genuine. If the checksum sits on the same web page as the download, an attacker who can replace one can replace both; it then guards only against corruption. For authenticity use a signature (GPG, Sigstore, or a signed package manager) or a checksum fetched over a separate channel.
Which algorithm
Prefer SHA-256 or SHA-512. A matching MD5 or SHA-1 only shows the file was not accidentally damaged: both can be forged by a deliberate attacker.
Large files
The file hash page reads the whole file into the tab's memory, so it stops at 256 MB. For an ISO or larger, use the command-line tools above.