Guides / Security basics

How to Verify a Download with a Hash

A hash is a short fingerprint calculated from a file. If even one byte changes, the fingerprint changes. Publishers often list a SHA-256 hash next to a download so you can check that the file arrived intact and unaltered.

What a hash does and does not do

A hash function turns any input, from a single word to a multi-gigabyte file, into a fixed-length string of characters. It is one-way, so you cannot rebuild the file from its hash. It is not encryption and does not hide anything. Its job is to detect changes.

How to check a download

1. Find the checksum on the publisher's official download page. Use the page you reached by typing the address yourself, not a link from an email or ad.
2. Calculate the hash of the file you downloaded. Choose SHA-256 unless the publisher says otherwise.
3. Compare the two strings character by character. If they match exactly, the file is what the publisher released. If they differ, do not run the file. Download it again from the official site.

Why SHA-1 is not enough

SHA-1 is still listed by some tools, but researchers demonstrated practical collisions in 2017, where two different files share a hash. For checking an honest download by mistake, it still catches corruption. For security, where someone might deliberately swap a file, use SHA-256 or SHA-512.

A note on MD5

MD5 is even older and has known collisions, so it should not be used for security checks. You may still see MD5 checksums on older sites. Treat them as a basic corruption check only.

Try it yourself

The Hash Generator calculates SHA-256, SHA-512, SHA-384 and SHA-1 for text or for a file. Files are read on your device and never uploaded.