How to Verify File Checksums on Windows (SHA-256 in 4 Steps)

The download finished, but did it arrive intact and unmodified? How to read a published hash, compute your own and compare them properly.

A checksum is a fingerprint of a file. The publisher calculates it, you calculate it from your copy, and if the two strings match, the file arrived byte for byte identical. Change one bit on the way and the value changes completely. That is the whole trick, and it takes about two minutes.

Know which hash you are looking at

MD5 and SHA-1 are still printed on older pages, but both have known collision attacks, so treat them as transfer-error checks only. SHA-256 is the current standard and is what vendors ship for ISOs, installers and archive parts. The CRC32 column in a file manager is weaker still: it catches a damaged download, never a deliberate swap.

Compute your own hash

1. Copy the published hash somewhere you can compare it against later, exactly as written.
2. Open Terminal or PowerShell and move into the folder that holds the file, for example cd Downloads.
3. Run certutil -hashfile yourfile.exe SHA256. The output is the hash of your local copy, in uppercase.
4. In PowerShell, Get-FileHash .\yourfile.exe -Algorithm SHA256 prints the same value in lowercase.
5. Compare the two strings character by character. Case and stray spaces do not matter; one wrong character does.

When a publisher ships a manifest

Bigger projects drop a .sha256 or .txt file next to the build. On Windows, 7-Zip can compute hashes for many files at once from the file properties: select the parts, open Properties, pick CRC SHA and choose SHA-256. If you keep a Linux live stick around or use WSL, sha256sum -c manifest.txt verifies the entire list in one command.

What to do when the values differ

• Download again from a different network or another official source before anything else; truncated transfers cause most mismatches.
• Compare the file size against the listing on the publisher page, down to the byte.
• Do not run the file to see whether it works when the hash is wrong. That is the exact scenario the check exists for.
• If the hash matches the vendor but the file still behaves strangely, check the digital signature as well under file Properties, Digital Signatures.

A habit worth keeping

Keep the vendor hash in a text file next to any installer you archive, and re-verify when you move a library to a NAS or a new drive. Silent corruption on cheap drives is rare, but the check costs seconds and turns a guess into a fact.