Windows & Mac · Guide
How to Verify a Download Checksum on Windows and Mac
Short answer
On Windows, run certutil -hashfile filename SHA256 in Command Prompt. On macOS, run shasum -a 256 filename in Terminal. Compare the output with the value published by the developer — they must match exactly.
Requirements
- The downloaded file
- The publisher's official SHA-256 value
- Command Prompt, PowerShell, or Terminal
Steps
1. Find the official hash
Get the checksum from the developer's own download page or signed release notes — never from the same third-party mirror that hosted the file.
2. Hash the file on Windows
Open Command Prompt, type certutil -hashfile "C:\Users\You\Downloads\setup.exe" SHA256 and press Enter. PowerShell users can run Get-FileHash instead.
3. Hash the file on macOS
Open Terminal, type shasum -a 256 then drag the file into the window to insert its path, and press Enter.
4. Compare the values
Paste both strings into a text editor and compare them. Any difference at all means the file is not the one the developer published.
5. Prefer a signature when offered
A PGP signature proves who published the file, not just that it is unmodified. Projects like VeraCrypt and KeePassXC publish both.
Alternative methods
1. Use PeaZip's hash tool
PeaZip includes a checksum window that computes SHA-256 without touching the command line.
2. Check the signature on the installer
On Windows, right-click the file, open Properties > Digital Signatures, and confirm the signer name matches the developer.
Troubleshooting
The hashes do not match
Delete the file. Re-download from the official source; if it still differs, do not run it.
certutil is not recognized
Use PowerShell instead: Get-FileHash -Algorithm SHA256 path\to\file.
The publisher only lists MD5
MD5 detects accidental corruption but is not collision-resistant. Treat it as an integrity check only, not proof of authenticity.
Frequently asked questions
Does a matching hash mean the file is safe?
It means the file matches what the publisher released. If the publisher itself is untrustworthy, a matching hash proves nothing about safety.
Which algorithm should I use?
SHA-256 when it is offered. Use SHA-1 or MD5 only when nothing better is published.