How to verify a download against its checksum

A publisher lists a digest beside the download. Checking your copy against it tells you whether the file arrived intact.

Calculating a hash and verifying one are related but different jobs, which is why they are separate tools. Calculating asks "what is this file's digest?". Verifying asks "does this file match the digest I was given?" — and that second question involves a pasted string that arrives damaged surprisingly often.

Step-by-step

1. Find the published digest. It is usually beside the download link, or in a file called SHA256SUMS or similar.
2. Paste it in. Extra spaces, line breaks, upper or lower case are all fine. If you paste a whole SHA256SUMS line, the filename on the end is ignored.
3. Add your downloaded file. It is read locally; nothing is sent.
4. Read the verdict. Match or no match, with the two digests shown so you can see where they diverge.

What the tool forgives, and what it will not

Whitespace and letter case are forgiven, because a digest copied out of a terminal or a PDF frequently picks up both. A wrong length is not forgiven, and the tool says so plainly rather than reporting a mismatch. A 40-character string is a SHA-1 digest, not a truncated SHA-256, and telling you "no match" when the real problem is that you have pasted the wrong kind of digest would be unhelpful.

The algorithm is chosen from the length of what you paste: 64 characters means SHA-256, 96 means SHA-384, 128 means SHA-512.

What a matching checksum actually proves

It proves the file you have is the file whose digest you were given. That is genuinely useful — it catches truncated downloads, corrupted transfers and mirrors serving stale copies.

It does not prove the file is safe. If an attacker controls the page, they can change the download and the published digest together, and the two will agree perfectly. A checksum defends against accident and against a compromised mirror; against a compromised source it defends against nothing. That is what signatures are for.

Frequently asked questions

The digest has spaces or newlines in it. Does that matter?

No. Whitespace and case are stripped before comparison, and a trailing filename from a SHA256SUMS line is ignored. Only a string of the wrong length is refused, and the tool explains why.

It says no match. What now?

Download the file again — an interrupted or resumed download is the usual cause. If it still disagrees, check you are comparing against the digest for the right file and the right version.

Does a match mean the file is safe?

It means your copy matches the digest you were given. If the file and the digest came from the same compromised page, they will match and still be malicious. For that you need a signature from a key you already trust.