[{"data":1,"prerenderedAt":497},["ShallowReactive",2],{"guide-file-integrity-hashing":3},{"id":4,"title":5,"body":6,"date":489,"description":490,"extension":491,"meta":492,"navigation":90,"path":493,"readingTime":168,"seo":494,"stem":495,"__hash__":496},"guides\u002Fguides\u002Ffile-integrity-hashing.md","File Integrity Verification With Hashes",{"type":7,"value":8,"toc":472},"minimark",[9,14,18,21,25,28,39,42,47,50,54,58,118,132,136,178,182,189,233,237,240,246,249,263,266,270,273,313,316,320,398,402,431,435,455,459,468],[10,11,13],"h2",{"id":12},"why-file-integrity-matters","Why File Integrity Matters",[15,16,17],"p",{},"When you download a file from the internet, you trust that the file on your disk matches what the publisher uploaded. But files pass through CDNs, mirrors, and proxy servers — any of which could serve a modified version. Supply chain attacks, where legitimate software is replaced with malware, have targeted package managers, installers, and even ISO images.",[15,19,20],{},"Hash-based verification gives you a cryptographic guarantee that the file you received is bit-for-bit identical to the one the publisher released. If a single byte differs, the hash changes completely.",[10,22,24],{"id":23},"how-hash-verification-works","How Hash Verification Works",[15,26,27],{},"The publisher computes a hash of the original file and publishes it on a trusted channel (their website, a signed release page, or the release notes). After downloading, you compute the hash of your local copy and compare:",[29,30,35],"pre",{"className":31,"code":33,"language":34},[32],"language-text","Publisher:  sha256sum release-v2.tar.gz → e3b0c44298fc1c14...\nYou:        sha256sum release-v2.tar.gz → e3b0c44298fc1c14...\nMatch → File is intact\n","text",[36,37,33],"code",{"__ignoreMap":38},"",[15,40,41],{},"If the_hashes match, you have the authentic file. If they differ, the file was modified in transit or substituted.",[43,44,46],"h3",{"id":45},"why-sha-256","Why SHA-256",[15,48,49],{},"SHA-256 is the current standard for file integrity. It produces a 256-bit (64-character hex) digest with no known collision attacks. MD5 and SHA-1 are deprecated for security purposes because practical collision attacks exist — an attacker could craft a malicious file with the same MD5 or SHA-1 hash as the legitimate one.",[10,51,53],{"id":52},"step-by-step-verification","Step-by-Step Verification",[43,55,57],{"id":56},"linux-and-macos","Linux and macOS",[29,59,63],{"className":60,"code":61,"language":62,"meta":38,"style":38},"language-bash shiki shiki-themes github-light github-dark","# Generate the hash\nsha256sum downloaded-file.zip\n\n# Compare with the published hash\necho \"expected-hash-here  downloaded-file.zip\" | sha256sum --check\n","bash",[36,64,65,74,85,92,98],{"__ignoreMap":38},[66,67,70],"span",{"class":68,"line":69},"line",1,[66,71,73],{"class":72},"sJ8bj","# Generate the hash\n",[66,75,77,81],{"class":68,"line":76},2,[66,78,80],{"class":79},"sScJk","sha256sum",[66,82,84],{"class":83},"sZZnC"," downloaded-file.zip\n",[66,86,88],{"class":68,"line":87},3,[66,89,91],{"emptyLinePlaceholder":90},true,"\n",[66,93,95],{"class":68,"line":94},4,[66,96,97],{"class":72},"# Compare with the published hash\n",[66,99,101,105,108,112,115],{"class":68,"line":100},5,[66,102,104],{"class":103},"sj4cs","echo",[66,106,107],{"class":83}," \"expected-hash-here  downloaded-file.zip\"",[66,109,111],{"class":110},"szBVR"," |",[66,113,114],{"class":79}," sha256sum",[66,116,117],{"class":103}," --check\n",[15,119,120,121,123,124,127,128,131],{},"If the file matches, ",[36,122,80],{}," prints ",[36,125,126],{},"downloaded-file.zip: OK",". If not, it prints ",[36,129,130],{},"FAILED"," and returns a non-zero exit code.",[43,133,135],{"id":134},"windows-powershell","Windows (PowerShell)",[29,137,141],{"className":138,"code":139,"language":140,"meta":38,"style":38},"language-powershell shiki shiki-themes github-light github-dark","# Generate the hash\nGet-FileHash downloaded-file.zip -Algorithm SHA256\n\n# Compare manually with the published hash\n$expected = \"e3b0c44298fc1c149afbf4c8996fb924...\"\n$actual = (Get-FileHash downloaded-file.zip -Algorithm SHA256).Hash\nif ($actual -eq $expected) { \"OK\" } else { \"MISMATCH\" }\n","powershell",[36,142,143,147,152,156,161,166,172],{"__ignoreMap":38},[66,144,145],{"class":68,"line":69},[66,146,73],{},[66,148,149],{"class":68,"line":76},[66,150,151],{},"Get-FileHash downloaded-file.zip -Algorithm SHA256\n",[66,153,154],{"class":68,"line":87},[66,155,91],{"emptyLinePlaceholder":90},[66,157,158],{"class":68,"line":94},[66,159,160],{},"# Compare manually with the published hash\n",[66,162,163],{"class":68,"line":100},[66,164,165],{},"$expected = \"e3b0c44298fc1c149afbf4c8996fb924...\"\n",[66,167,169],{"class":68,"line":168},6,[66,170,171],{},"$actual = (Get-FileHash downloaded-file.zip -Algorithm SHA256).Hash\n",[66,173,175],{"class":68,"line":174},7,[66,176,177],{},"if ($actual -eq $expected) { \"OK\" } else { \"MISMATCH\" }\n",[43,179,181],{"id":180},"cross-platform-quick-check","Cross-Platform Quick Check",[15,183,184,185,188],{},"Many publishers publish a ",[36,186,187],{},".sha256"," checksum file alongside the download:",[29,190,192],{"className":60,"code":191,"language":62,"meta":38,"style":38},"# Download both files\nwget https:\u002F\u002Fexample.com\u002Frelease-v2.tar.gz\nwget https:\u002F\u002Fexample.com\u002Frelease-v2.tar.gz.sha256\n\n# Verify\nsha256sum -c release-v2.tar.gz.sha256\n",[36,193,194,199,207,214,218,223],{"__ignoreMap":38},[66,195,196],{"class":68,"line":69},[66,197,198],{"class":72},"# Download both files\n",[66,200,201,204],{"class":68,"line":76},[66,202,203],{"class":79},"wget",[66,205,206],{"class":83}," https:\u002F\u002Fexample.com\u002Frelease-v2.tar.gz\n",[66,208,209,211],{"class":68,"line":87},[66,210,203],{"class":79},[66,212,213],{"class":83}," https:\u002F\u002Fexample.com\u002Frelease-v2.tar.gz.sha256\n",[66,215,216],{"class":68,"line":94},[66,217,91],{"emptyLinePlaceholder":90},[66,219,220],{"class":68,"line":100},[66,221,222],{"class":72},"# Verify\n",[66,224,225,227,230],{"class":68,"line":168},[66,226,80],{"class":79},[66,228,229],{"class":103}," -c",[66,231,232],{"class":83}," release-v2.tar.gz.sha256\n",[10,234,236],{"id":235},"checking-multiple-files","Checking Multiple Files",[15,238,239],{},"For releases with many files, publishers often provide a checksums file:",[29,241,244],{"className":242,"code":243,"language":34},[32],"e3b0c44298fc1c14...  release-v2.tar.gz\na7ffc6f8bf1ed766...  release-v2.zip\n2cf24dba5fb0a30e...  release-v2-installer.exe\n",[36,245,243],{"__ignoreMap":38},[15,247,248],{},"Download all files and the checksums file, then:",[29,250,252],{"className":60,"code":251,"language":62,"meta":38,"style":38},"sha256sum -c checksums.txt\n",[36,253,254],{"__ignoreMap":38},[66,255,256,258,260],{"class":68,"line":69},[66,257,80],{"class":79},[66,259,229],{"class":103},[66,261,262],{"class":83}," checksums.txt\n",[15,264,265],{},"This verifies every file listed and reports any mismatches.",[10,267,269],{"id":268},"verifying-signed-checksums","Verifying Signed Checksums",[15,271,272],{},"A hash alone only tells you the file matches the published hash. But what if the publisher's website was compromised and the hash was replaced? To verify authenticity, not just integrity, publishers sign checksum files with GPG:",[29,274,276],{"className":60,"code":275,"language":62,"meta":38,"style":38},"# Verify the signature on the checksums file\ngpg --verify checksums.txt.sig checksums.txt\n\n# Then verify the files against the checksums\nsha256sum -c checksums.txt\n",[36,277,278,283,296,300,305],{"__ignoreMap":38},[66,279,280],{"class":68,"line":69},[66,281,282],{"class":72},"# Verify the signature on the checksums file\n",[66,284,285,288,291,294],{"class":68,"line":76},[66,286,287],{"class":79},"gpg",[66,289,290],{"class":103}," --verify",[66,292,293],{"class":83}," checksums.txt.sig",[66,295,262],{"class":83},[66,297,298],{"class":68,"line":87},[66,299,91],{"emptyLinePlaceholder":90},[66,301,302],{"class":68,"line":94},[66,303,304],{"class":72},"# Then verify the files against the checksums\n",[66,306,307,309,311],{"class":68,"line":100},[66,308,80],{"class":79},[66,310,229],{"class":103},[66,312,262],{"class":83},[15,314,315],{},"The signature proves the checksums came from the publisher's private key. Two-layer verification — signature then hash — is the gold standard for security-critical downloads.",[10,317,319],{"id":318},"common-use-cases","Common Use Cases",[321,322,323,339],"table",{},[324,325,326],"thead",{},[327,328,329,333,336],"tr",{},[330,331,332],"th",{},"Scenario",[330,334,335],{},"What to verify",[330,337,338],{},"Where to find the hash",[340,341,342,354,365,376,387],"tbody",{},[327,343,344,348,351],{},[345,346,347],"td",{},"Operating system ISOs",[345,349,350],{},"The ISO file",[345,352,353],{},"Official release page",[327,355,356,359,362],{},[345,357,358],{},"npm\u002Fpip packages",[345,360,361],{},"Package tarball",[345,363,364],{},"Registry metadata",[327,366,367,370,373],{},[345,368,369],{},"Docker images",[345,371,372],{},"Image layers",[345,374,375],{},"Docker Hub manifest digest",[327,377,378,381,384],{},[345,379,380],{},"Firmware updates",[345,382,383],{},"Firmware binary",[345,385,386],{},"Vendor security page",[327,388,389,392,395],{},[345,390,391],{},"Database backups",[345,393,394],{},"Backup file",[345,396,397],{},"Your own records",[10,399,401],{"id":400},"common-mistakes","Common Mistakes",[403,404,405,413,419,425],"ul",{},[406,407,408,412],"li",{},[409,410,411],"strong",{},"Verifying only some files"," — if a release contains multiple files, verify all of them, not just the main archive",[406,414,415,418],{},[409,416,417],{},"Trusting the source of the hash"," — a hash on the same compromised server as the file is useless. Use signed checksums or compare across independent sources",[406,420,421,424],{},[409,422,423],{},"Using MD5 or SHA-1"," — these are vulnerable to collision attacks. Always use SHA-256 or stronger",[406,426,427,430],{},[409,428,429],{},"Ignoring mismatches"," — a hash mismatch means the file is not what the publisher released. Delete it and re-download from an official source",[10,432,434],{"id":433},"key-takeaways","Key Takeaways",[403,436,437,440,443,446,449,452],{},[406,438,439],{},"Hash verification confirms your downloaded file is bit-for-bit identical to the published original.",[406,441,442],{},"SHA-256 is the recommended algorithm — MD5 and SHA-1 are vulnerable to collision attacks.",[406,444,445],{},"Compare the hash you compute against the one published by the software author.",[406,447,448],{},"For security-critical downloads, verify signed checksums with GPG to confirm authenticity.",[406,450,451],{},"Always verify all files in a release, not just the main archive.",[406,453,454],{},"A hash mismatch means the file was modified — delete it and re-download from an official source.",[10,456,458],{"id":457},"try-it-yourself","Try It Yourself",[15,460,461,462,467],{},"Generate SHA-256 hashes for any file or text input with the ",[463,464,466],"a",{"href":465},"\u002Ftools\u002Fhash-calculator","Hash Calculator",".",[469,470,471],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":38,"searchDepth":76,"depth":76,"links":473},[474,475,478,483,484,485,486,487,488],{"id":12,"depth":76,"text":13},{"id":23,"depth":76,"text":24,"children":476},[477],{"id":45,"depth":87,"text":46},{"id":52,"depth":76,"text":53,"children":479},[480,481,482],{"id":56,"depth":87,"text":57},{"id":134,"depth":87,"text":135},{"id":180,"depth":87,"text":181},{"id":235,"depth":76,"text":236},{"id":268,"depth":76,"text":269},{"id":318,"depth":76,"text":319},{"id":400,"depth":76,"text":401},{"id":433,"depth":76,"text":434},{"id":457,"depth":76,"text":458},"2026-05-28","Use SHA-256 hashes to verify downloaded files haven't been tampered with — step by step.","md",{"immutable":90},"\u002Fguides\u002Ffile-integrity-hashing",{"title":5,"description":490},"guides\u002Ffile-integrity-hashing","_mYrUWqBUIxbmZijaSdX6P6lSaPQQg41dDdMvpQ3WhY",1780401333864]