What a checksum tells you
A checksum is a short value calculated from a file’s contents. You can calculate one for a file on your computer and compare it with a value supplied alongside a download or calculated from an original copy. If the values match, the files are very likely to have the same contents. If they differ, something is different: the file may have been changed, damaged, or replaced.
People often use “checksum” as a general term for this kind of comparison. For file verification, a cryptographic hash such as SHA-256 is a practical choice. It produces a long string of letters and numbers, often called a hash or digest. Even a small change to the file produces a different result. Older algorithms such as MD5 may still appear in download listings, but SHA-256 is a better default when you can choose the method.
A hash covers the file’s bytes, not everything about the file. Renaming a file normally leaves its hash unchanged. Changing its contents, including by saving it again in a way that alters the bytes, changes the hash. Two files that look identical when opened can therefore have different hashes.
Choose a value to compare against
Verification needs two values calculated with the same algorithm. For a download, look for a SHA-256 value published by the provider of the file. For a copy between drives or computers, calculate SHA-256 for the original file and then for the copied file. Keep track of which value belongs to which file, especially when several versions have similar names.
Treat the reference value with care. A checksum copied from an untrusted page or bundled with a suspicious file may have been changed along with the file. A match against that value shows consistency, not that the file came from the organization you expected. When authenticity matters, obtain the reference value through a channel you trust and use any additional verification method the provider offers.
Calculate a SHA-256 hash on your computer
On Windows, open PowerShell and run Get-FileHash -Algorithm SHA256 -Path "C:\path\to\file.zip". Replace the example path with the location of your file. The output includes a Hash field containing the value to compare.
On macOS, open Terminal and run shasum -a 256 "/path/to/file.zip". On most Linux systems, open a terminal and run sha256sum "/path/to/file.zip". Each command prints the hash followed by the file name. Quotation marks around a path help when it contains spaces.
Run the appropriate command once for each file you are comparing. For a large file, calculation may take a little while because the computer must read its contents. If the command reports that it cannot find the file, check the path rather than assuming the file failed verification.
Compare the results and handle a mismatch
Compare the complete hash, not just its first or last few characters. Uppercase and lowercase letters in the displayed value do not change the result, but every character must otherwise match. Also confirm that both values are labeled SHA-256; a SHA-256 hash cannot be compared meaningfully with an MD5 or SHA-1 hash.
If the values differ, first check that you hashed the intended file and used the correct reference value for that version. A download may have a newer release, and a copied file may have been edited after the copy. If those possibilities do not explain the difference, download or copy the file again and calculate its hash anew. Do not rely on a mismatched file when an exact copy is required.
A matching hash is strong evidence that the checked file’s contents match the reference file’s contents. It does not by itself tell you whether the contents are safe to run, whether the original was trustworthy, or whether the file will work correctly. Use checksum verification as one step in a broader habit of getting files from trusted providers, keeping track of versions, and treating unexpected changes as a reason to investigate.
