HowToCodePage

Checksums & verifying files

How to confirm a downloaded file is intact and unmodified using a checksum, and the limits of the technique.

Why verify a file

When you download software, a flipped bit or a tampered mirror can corrupt or poison the file. A published checksum lets you confirm the bytes you received match what the publisher intended.

# Linux / macOS
sha256sum downloaded.iso

# Windows (PowerShell)
Get-FileHash downloaded.iso -Algorithm SHA256

What a checksum cannot prove

⚠️
A checksum only proves the file matches a known value. If the attacker controls both the file and the published checksum on the same page, verification passes. For supply-chain trust use code signing or reproducible builds.
  • Checksums detect accidental corruption (transmission errors).
  • Signatures (GPG, Sigstore) detect malicious tampering by an unknown party.
  • Prefer SHA-256 over MD5/SHA-1 for new publish checksums.

FAQ

My checksum differs from the published one — what now?
Do not use the file. Re-download from the official source and compare again; if it still differs, the source or mirror is compromised or corrupted.

Hash functions: MD5, SHA-1, SHA-256

Last refreshed 2026-09-17.