What is a checksum, and how do you verify a download?

A checksum is a short fingerprint calculated from a file's contents. Change a single byte in the file and the fingerprint changes completely. Publishers list the checksum next to the download so you can confirm that what you received matches what they published.

What a checksum does and does not tell you

A matching checksum shows the file was not corrupted in transit and was not swapped for a different file after the checksum was recorded. It does not prove the software is safe. A publisher can publish the checksum of a harmful file. Pair the check with a trusted source and an up-to-date antivirus.

How to check on your computer

Windows (PowerShell)

Get-FileHash .\setup.exe -Algorithm SHA256

macOS

shasum -a 256 ~/Downloads/app.dmg

Linux

sha256sum ~/Downloads/app.deb

Each command prints a 64-character string. Compare it with the checksum on the software page, character by character. If you are checking a long string, paste both into the Text Compare tool.

You can also check in the browser

The Hash Generator can calculate the SHA-256 of a file without uploading it. Choose your file and compare the result.

If the checksums do not match

Do not run the file. Download it again from the same source. If it still does not match, try another source or contact the publisher, and report the problem to us so we can review the listing.