File Integrity Verification With Hashes

Why File Integrity Matters

When you download a file from the internet, you trust that the file on your disk matches what the publisher uploaded. But files pass through CDNs, mirrors, and proxy servers — any of which could serve a modified version. Supply chain attacks, where legitimate software is replaced with malware, have targeted package managers, installers, and even ISO images.

Hash-based verification gives you a cryptographic guarantee that the file you received is bit-for-bit identical to the one the publisher released. If a single byte differs, the hash changes completely.

How Hash Verification Works

The publisher computes a hash of the original file and publishes it on a trusted channel (their website, a signed release page, or the release notes). After downloading, you compute the hash of your local copy and compare:

Publisher:  sha256sum release-v2.tar.gz → e3b0c44298fc1c14...
You:        sha256sum release-v2.tar.gz → e3b0c44298fc1c14...
Match → File is intact

If the_hashes match, you have the authentic file. If they differ, the file was modified in transit or substituted.

Why SHA-256

SHA-256 is the current standard for file integrity. It produces a 256-bit (64-character hex) digest with no known collision attacks. MD5 and SHA-1 are deprecated for security purposes because practical collision attacks exist — an attacker could craft a malicious file with the same MD5 or SHA-1 hash as the legitimate one.

Step-by-Step Verification

Linux and macOS

# Generate the hash
sha256sum downloaded-file.zip

# Compare with the published hash
echo "expected-hash-here  downloaded-file.zip" | sha256sum --check

If the file matches, sha256sum prints downloaded-file.zip: OK. If not, it prints FAILED and returns a non-zero exit code.

Windows (PowerShell)

# Generate the hash
Get-FileHash downloaded-file.zip -Algorithm SHA256

# Compare manually with the published hash
$expected = "e3b0c44298fc1c149afbf4c8996fb924..."
$actual = (Get-FileHash downloaded-file.zip -Algorithm SHA256).Hash
if ($actual -eq $expected) { "OK" } else { "MISMATCH" }

Cross-Platform Quick Check

Many publishers publish a .sha256 checksum file alongside the download:

# Download both files
wget https://example.com/release-v2.tar.gz
wget https://example.com/release-v2.tar.gz.sha256

# Verify
sha256sum -c release-v2.tar.gz.sha256

Checking Multiple Files

For releases with many files, publishers often provide a checksums file:

e3b0c44298fc1c14...  release-v2.tar.gz
a7ffc6f8bf1ed766...  release-v2.zip
2cf24dba5fb0a30e...  release-v2-installer.exe

Download all files and the checksums file, then:

sha256sum -c checksums.txt

This verifies every file listed and reports any mismatches.

Verifying Signed Checksums

A hash alone only tells you the file matches the published hash. But what if the publisher's website was compromised and the hash was replaced? To verify authenticity, not just integrity, publishers sign checksum files with GPG:

# Verify the signature on the checksums file
gpg --verify checksums.txt.sig checksums.txt

# Then verify the files against the checksums
sha256sum -c checksums.txt

The signature proves the checksums came from the publisher's private key. Two-layer verification — signature then hash — is the gold standard for security-critical downloads.

Common Use Cases

Common Mistakes

• Verifying only some files — if a release contains multiple files, verify all of them, not just the main archive
• Trusting the source of the hash — a hash on the same compromised server as the file is useless. Use signed checksums or compare across independent sources
• Using MD5 or SHA-1 — these are vulnerable to collision attacks. Always use SHA-256 or stronger
• Ignoring mismatches — a hash mismatch means the file is not what the publisher released. Delete it and re-download from an official source

Key Takeaways

• Hash verification confirms your downloaded file is bit-for-bit identical to the published original.
• SHA-256 is the recommended algorithm — MD5 and SHA-1 are vulnerable to collision attacks.
• Compare the hash you compute against the one published by the software author.
• For security-critical downloads, verify signed checksums with GPG to confirm authenticity.
• Always verify all files in a release, not just the main archive.
• A hash mismatch means the file was modified — delete it and re-download from an official source.

Try It Yourself

Generate SHA-256 hashes for any file or text input with the Hash Calculator.