MD5 and SHA-256 hash checker

A checksum, also called a hash, is a short string of letters and numbers calculated from every byte in a file. The same file always gives the same checksum, and changing even a single byte gives a completely different one. That makes it a fingerprint for the file's contents.

Software publishers list the checksum next to their downloads. When you calculate the checksum of the file you downloaded and it matches theirs, you know you have exactly the file they published, not a corrupted or modified copy.

• Corrupted downloads: A dropped connection or a failing disk can damage a large file without any error message. A broken ISO image often fails halfway through an install, long after you've forgotten where it came from.
• Tampered files: Attackers who break into a download mirror can swap a file for one with malware inside. In 2016, the Linux Mint website was hacked and its download link pointed to an ISO with a backdoor.
• The wrong file: Checking the checksum also catches a mixed-up version, such as an ARM build instead of x64, or an older release served from a cache.

1. Drop your downloaded file into the tool above, or click to select it.
2. Copy the checksum from the download page and paste it into the expected checksum field.
3. The tool tells you if they match. It detects MD5, SHA-1, SHA-256 and SHA-512 from the length of the checksum.

You can also paste a whole line from a checksum file, such as 9f86d0…0a08 *ubuntu.iso, and the checksum is picked out for you.

Why it's safe for private files

Most online hash calculators upload your file to their server first. This one uses your browser's own processing to read the file in small pieces, so nothing leaves your device. That also means there's no upload to wait for, and very large files work.

Windows has a checksum tool built into PowerShell. Open PowerShell (search for it in the Start menu), go to the folder with your file, then run:

cd $HOME\Downloads
Get-FileHash .\ubuntu.iso

This prints the SHA-256 checksum by default. For other algorithms, add -Algorithm MD5, -Algorithm SHA1 or -Algorithm SHA512. To compare with the expected checksum without reading it character by character, run:

(Get-FileHash .\ubuntu.iso).Hash -eq "paste-the-expected-checksum-here"

PowerShell prints True if they match and False if they don't. In the older Command Prompt, use certutil -hashfile ubuntu.iso SHA256 instead.

Open Terminal (in Applications > Utilities), go to the folder with your file, then run:

cd ~/Downloads
shasum -a 256 app.dmg

Replace 256 with 1 or 512 for SHA-1 or SHA-512. For MD5, run md5 app.dmg. To have Terminal compare the checksums for you, run:

echo "paste-the-expected-checksum-here  app.dmg" | shasum -a 256 -c

It prints app.dmg: OK when they match. Note the two spaces between the checksum and the file name.

Every major Linux distribution comes with checksum tools. In a terminal, run:

sha256sum ubuntu.iso

The same works with md5sum, sha1sum and sha512sum. Many projects publish a checksum file, often called SHA256SUMS, that lists all their downloads. Put it in the same folder as your file and run:

sha256sum -c SHA256SUMS --ignore-missing

It prints ubuntu.iso: OK for each file that matches. --ignore-missing skips the files listed that you didn't download.

All four do the same job, but MD5 and SHA-1 are no longer safe against someone deliberately faking a file. They still catch accidental corruption, which is why many download pages list them.

If a download page offers several checksums, use SHA-256 or SHA-512.

Don't open or install the file. Then work through these, most likely first:

• Check you're comparing the same algorithm. A SHA-256 checksum will never match an MD5 one.
• Check you downloaded the exact version the checksum is for, including the version number and whether it's x64 or ARM.
• Delete the file and download it again, preferably from the official site rather than a mirror.
• If a fresh download from the official site still doesn't match, contact the publisher and don't use the file.

A matching checksum proves your file is identical to the one the checksum was made from. It doesn't prove that file is safe. If attackers control the website, they can replace both the download and the checksum next to it.

For stronger protection, get the checksum from a different place than the file, like the official site when you downloaded from a mirror. Some projects also sign their checksum files with GPG, which proves the checksums came from the publisher.