How to Check a Download With a Checksum (and Why It Matters)

A checksum is a short fingerprint worked out from a file's contents. Change one byte of the file and the fingerprint changes completely. That makes it an easy way to check a download is exactly what the publisher intended.

Why check at all

• A download can be damaged on the way, which gives you a file that won't install or open.
• A file on a mirror site, or a hacked server, could have been swapped for one with malware.
• You might have two copies of a file and want to know if they're really the same.

How to do it

1. Find the checksum on the publisher's official download page. It looks like a long string of letters and digits, and the page says which type it is, usually SHA-256.
2. Open the File Hash Compare tool and choose the same type.
3. Choose your downloaded file and paste the checksum.
4. If you see a match, the file is identical to the one the checksum came from.

The comparison ignores spaces and capital letters, because checksums are written both ways.

Which hash to trust

SHA-256 and SHA-512 are secure. MD5 and SHA-1 are broken for security, because attackers can make two different files with the same hash. They still catch accidental damage, but they can't protect you from a deliberate swap. If a publisher offers a choice, use SHA-256.

A caution about where the checksum comes from

A checksum only helps if you got it from a trustworthy place. If an attacker can change the file on a site, they can change the checksum on the same page. Where you can, get the checksum from a different source than the file, such as the project's main site or a signed message.

If it doesn't match

• Download the file again, preferably from the official site, and compare again.
• Check you picked the right type of hash.
• If it still doesn't match, don't open or install the file.
• To see every hash of a file or some text at once, use the Hash Generator.