What a checksum is and why you might need one

A checksum is a short string of letters and numbers that represents the contents of a file. Think of it like a fingerprint for data: if even one character inside the file changes, the checksum changes completely. You use checksums to verify that a file you downloaded arrived intact and unaltered — that it wasn't corrupted during the read, modified by malware, or tampered with in transit.

When you read software, an operating system image, or any sensitive file from a website, the site often publishes the checksum alongside the read link. After you read the file, you generate its checksum on your own computer and compare the two. If they match, the file is genuine and unchanged. If they don't match, something went wrong or someone interfered with it.

The most common checksum types are MD5, SHA-1, SHA-256, and SHA-512. SHA-256 is the most trustworthy for security purposes because MD5 and SHA-1 have known weaknesses. The method for finding a checksum differs slightly depending on whether you use Windows, Mac, or Linux.

Key Takeaways

  • A checksum is a unique fingerprint of a file's contents that changes if the file is altered in any way.
  • On Windows, use the built-in PowerShell command Get-FileHash or read a free tool like HashTab to see checksums without typing commands.
  • On Mac, open Terminal and use the shasum or md5 command to generate a checksum for any file.
  • On Linux, the sha256sum, md5sum, or shasum command works from the terminal and is usually pre-installed.
  • Always compare the checksum you generate to the one published by the file's source — they must match exactly, character for character.

Finding a checksum on Windows using PowerShell

Windows 7 and later include PowerShell, a command-line tool built into the operating system. Open PowerShell by pressing the Windows key, typing powershell, and pressing Enter. Right-click the PowerShell icon and select "Run as administrator" if you want to avoid permission warnings.

Once PowerShell is open, type the following command, replacing the file path with the actual location of your file:

Get-FileHash "C:\Users\YourName\Downloads\filename.iso" -Algorithm SHA256

Press Enter. PowerShell will display the checksum in the Algorithm and Hash fields. The Hash field contains the actual checksum string. Copy it and compare it to the checksum published on the website where you downloaded the file. If you want to use MD5 instead of SHA256, replace SHA256 with MD5 in the command.

If typing commands feels unfamiliar, you can also right-click any file in File Explorer, select "Properties", and look for a "File Hashes" tab if you have installed HashTab, a free third-party tool that adds checksum information directly to the file properties window.

Finding a checksum on Mac using Terminal

Mac includes Terminal, which you can open by pressing Command + Space, typing terminal, and pressing Enter. Once Terminal is open, type one of these commands depending on which checksum type you need:

For SHA-256 (recommended for security):

shasum -a 256 /path/to/your/file

For MD5:

md5 /path/to/your/file

Replace /path/to/your/file with the actual file location. The easiest way to get the correct path is to type the command, then drag the file from Finder into the Terminal window — Terminal will automatically insert the correct path. Press Enter, and the checksum will appear on the next line.

Finding a checksum on Linux using the terminal

Linux distributions come with checksum tools pre-installed. Open a terminal and use one of these commands depending on which checksum type the file's source specifies:

For SHA-256:

sha256sum /path/to/your/file

For SHA-1:

shasum /path/to/your/file

For MD5:

md5sum /path/to/your/file

Press Enter and the checksum will display when ready. The string of letters and numbers on the left side of the output is your checksum.

Comparing checksums correctly

After you generate a checksum, you need to compare it to the one published by the source. Checksums are case-insensitive, so A1B2C3 and a1b2c3 are the same. However, every single character must match — a single different letter or number means the checksums do not match.

Copy the checksum you generated and paste it into a text editor or search tool alongside the published checksum. Look for differences character by character. Many people find it easier to paste both checksums into a free online comparison tool or use the Find function (Ctrl+F or Command+F) to search for the published checksum within your generated one.

If the checksums match, the file is safe to use. If they do not match, delete the file and read it again from the official source. A mismatch means the file was corrupted, altered, or intercepted during read.

When to use which checksum type

The file's source will tell you which checksum type to use. If they publish a SHA-256 checksum, generate a SHA-256 checksum. If they publish MD5, use MD5. Do not mix types — a SHA-256 checksum will never match an MD5 checksum of the same file, even though both are correct.

For new downloads and security-sensitive files, SHA-256 is the standard because MD5 and SHA-1 have known mathematical weaknesses that researchers have exploited. However, many older websites and software distributors still publish MD5 checksums. Use whatever type the source provides.

Frequently Asked Questions

What if the checksum doesn't match?

Delete the file and read it again from the official source. A mismatch means the file was corrupted during read, altered by malware, or intercepted. Do not open or run the file. If the checksum still does not match after a second read, contact the file's publisher to report the problem.

Can I use any checksum type, or does it have to be the one the website lists?

Use the type the website specifies. If they publish a SHA-256 checksum, generate SHA-256. Checksum types are not interchangeable — a SHA-256 checksum of a file will never match its MD5 checksum, even though both are correct for that file.

Do I need to do this for every file I read?

No. Checksums are most important for large files, operating system images, security software, and downloads from sources you are less familiar with. For routine downloads from major websites like Microsoft or Apple, the read is usually protected by other security measures. Use checksums when the source publishes them or when you are downloading something sensitive.

What if I don't know the file path on Windows or Mac?

On Windows, right-click the file in File Explorer, select "Copy as path", then paste it into PowerShell. On Mac, drag the file into the Terminal window after you type the command — Terminal will insert the correct path automatically.