When you download an installer, a disk image or an important document, the website often shows a long string of letters and numbers next to it. That is the file’s checksum. Comparing it takes a minute and can protect you from corrupted or tampered files.
What a checksum is
A checksum is a short fingerprint calculated from every byte of a file. If even one byte changes, the fingerprint changes completely. SHA-256 is a widely used method that produces a 64-character result.
Why check
- The download may have been interrupted or corrupted on the way.
- A file on an unofficial mirror may have been changed by someone else.
If your calculated checksum matches the one on the official page, you have the same file the publisher made.
Steps
- Download the file and copy the checksum shown on the official download page.
- Open the file checksum tool.
- Add your downloaded file and choose SHA-256.
- Compare the result with the published one, character by character or by pasting both into a text difference checker.
The calculation happens on your device, so the file is not uploaded. That matters for large or private files.
If they do not match
- Download the file again and check once more.
- Make sure you copied the checksum for the same file and version.
- Make sure you did not choose a different algorithm (SHA-256 is not the same as MD5 or SHA-1).
- If it still does not match, do not run the file. Get it from the official source.
A caution
A matching checksum only proves the file equals the one the checksum belongs to. If an attacker controls both the file and the page that shows the checksum, it proves nothing, so always take the checksum from the publisher’s own site over a secure connection.