[{"data":1,"prerenderedAt":590},["ShallowReactive",2],{"guide-verifying-file-downloads-hashes":3},{"id":4,"title":5,"body":6,"date":582,"description":583,"extension":584,"meta":585,"navigation":106,"path":586,"readingTime":116,"seo":587,"stem":588,"__hash__":589},"guides\u002Fguides\u002Fverifying-file-downloads-hashes.md","Verifying File Downloads with Hashes: A Practical Guide",{"type":7,"value":8,"toc":559},"minimark",[9,14,18,21,25,30,46,57,60,64,68,141,148,192,196,199,230,233,244,248,251,298,302,377,380,384,387,391,394,435,438,442,477,481,485,488,492,499,503,506,510,537,541,550,555],[10,11,13],"h2",{"id":12},"why-verify-downloaded-files","Why Verify Downloaded Files?",[15,16,17],"p",{},"When you download a file — whether an operating system ISO, a software package, or a firmware update — you need assurance that what you received is what the publisher intended. Files can be corrupted during transfer, modified by a compromised mirror, or intercepted and altered by a man-in-the-middle attack.",[15,19,20],{},"Hash verification gives you a mathematical guarantee: if the hash of your downloaded file matches the publisher's published hash, the file is bit-for-bit identical to the original.",[10,22,24],{"id":23},"how-hash-verification-works","How Hash Verification Works",[26,27,29],"h3",{"id":28},"the-process","The Process",[31,32,33,37,40,43],"ol",{},[34,35,36],"li",{},"The publisher computes a hash (typically SHA-256) of the original file",[34,38,39],{},"The publisher publishes the hash value on their website or in a signed manifest",[34,41,42],{},"You download the file and compute its hash locally",[34,44,45],{},"You compare the two hash values — a match confirms integrity",[47,48,53],"pre",{"className":49,"code":51,"language":52},[50],"language-text","Original File → SHA-256 → a]b3f2c...9001d (published hash)\nDownloaded File → SHA-256 → a]b3f2c...9001d (your computed hash)\nMatch → File is verified ✅\n","text",[54,55,51],"code",{"__ignoreMap":56},"",[15,58,59],{},"Even a single bit difference produces a completely different hash. This is the avalanche effect — a core property of cryptographic hash functions.",[10,61,63],{"id":62},"verifying-files-on-different-operating-systems","Verifying Files on Different Operating Systems",[26,65,67],{"id":66},"linux-and-macos","Linux and macOS",[47,69,73],{"className":70,"code":71,"language":72,"meta":56,"style":56},"language-bash shiki shiki-themes github-light github-dark","# SHA-256 (recommended)\nsha256sum ubuntu-24.04-desktop-amd64.iso\n# Expected output: e]b3f2c8d7a1...9001d  ubuntu-24.04-desktop-amd64.iso\n\n# MD5 (legacy, still published by some vendors)\nmd5sum ubuntu-24.04-desktop-amd64.iso\n\n# SHA-1 (deprecated but still encountered)\nsha1sum ubuntu-24.04-desktop-amd64.iso\n","bash",[54,74,75,84,95,101,108,114,122,127,133],{"__ignoreMap":56},[76,77,80],"span",{"class":78,"line":79},"line",1,[76,81,83],{"class":82},"sJ8bj","# SHA-256 (recommended)\n",[76,85,87,91],{"class":78,"line":86},2,[76,88,90],{"class":89},"sScJk","sha256sum",[76,92,94],{"class":93},"sZZnC"," ubuntu-24.04-desktop-amd64.iso\n",[76,96,98],{"class":78,"line":97},3,[76,99,100],{"class":82},"# Expected output: e]b3f2c8d7a1...9001d  ubuntu-24.04-desktop-amd64.iso\n",[76,102,104],{"class":78,"line":103},4,[76,105,107],{"emptyLinePlaceholder":106},true,"\n",[76,109,111],{"class":78,"line":110},5,[76,112,113],{"class":82},"# MD5 (legacy, still published by some vendors)\n",[76,115,117,120],{"class":78,"line":116},6,[76,118,119],{"class":89},"md5sum",[76,121,94],{"class":93},[76,123,125],{"class":78,"line":124},7,[76,126,107],{"emptyLinePlaceholder":106},[76,128,130],{"class":78,"line":129},8,[76,131,132],{"class":82},"# SHA-1 (deprecated but still encountered)\n",[76,134,136,139],{"class":78,"line":135},9,[76,137,138],{"class":89},"sha1sum",[76,140,94],{"class":93},[15,142,143,144,147],{},"On macOS, use ",[54,145,146],{},"shasum"," instead:",[47,149,151],{"className":70,"code":150,"language":72,"meta":56,"style":56},"# SHA-256 on macOS\nshasum -a 256 CentOS-Stream-9-x86_64-dvd1.iso\n\n# SHA-1 on macOS\nshasum -a 1 CentOS-Stream-9-x86_64-dvd1.iso\n",[54,152,153,158,172,176,181],{"__ignoreMap":56},[76,154,155],{"class":78,"line":79},[76,156,157],{"class":82},"# SHA-256 on macOS\n",[76,159,160,162,166,169],{"class":78,"line":86},[76,161,146],{"class":89},[76,163,165],{"class":164},"sj4cs"," -a",[76,167,168],{"class":164}," 256",[76,170,171],{"class":93}," CentOS-Stream-9-x86_64-dvd1.iso\n",[76,173,174],{"class":78,"line":97},[76,175,107],{"emptyLinePlaceholder":106},[76,177,178],{"class":78,"line":103},[76,179,180],{"class":82},"# SHA-1 on macOS\n",[76,182,183,185,187,190],{"class":78,"line":110},[76,184,146],{"class":89},[76,186,165],{"class":164},[76,188,189],{"class":164}," 1",[76,191,171],{"class":93},[26,193,195],{"id":194},"windows","Windows",[15,197,198],{},"PowerShell includes built-in hash commands:",[47,200,204],{"className":201,"code":202,"language":203,"meta":56,"style":56},"language-powershell shiki shiki-themes github-light github-dark","# SHA-256\nGet-FileHash .\\node-v22.0.0-x64.msi -Algorithm SHA256\n\n# MD5\nGet-FileHash .\\node-v22.0.0-x64.msi -Algorithm MD5\n","powershell",[54,205,206,211,216,220,225],{"__ignoreMap":56},[76,207,208],{"class":78,"line":79},[76,209,210],{},"# SHA-256\n",[76,212,213],{"class":78,"line":86},[76,214,215],{},"Get-FileHash .\\node-v22.0.0-x64.msi -Algorithm SHA256\n",[76,217,218],{"class":78,"line":97},[76,219,107],{"emptyLinePlaceholder":106},[76,221,222],{"class":78,"line":103},[76,223,224],{},"# MD5\n",[76,226,227],{"class":78,"line":110},[76,228,229],{},"Get-FileHash .\\node-v22.0.0-x64.msi -Algorithm MD5\n",[15,231,232],{},"The CertUtil command also works in Command Prompt:",[47,234,238],{"className":235,"code":236,"language":237,"meta":56,"style":56},"language-cmd shiki shiki-themes github-light github-dark","certutil -hashfile node-v22.0.0-x64.msi SHA256\n","cmd",[54,239,240],{"__ignoreMap":56},[76,241,242],{"class":78,"line":79},[76,243,236],{},[26,245,247],{"id":246},"automating-verification","Automating Verification",[15,249,250],{},"Create a checksum file and verify against it:",[47,252,254],{"className":70,"code":253,"language":72,"meta":56,"style":56},"# Publisher creates a checksum file\nsha256sum release.tar.gz > release.tar.gz.sha256\n\n# User verifies\nsha256sum -c release.tar.gz.sha256\n# Output: release.tar.gz: OK\n",[54,255,256,261,275,279,284,293],{"__ignoreMap":56},[76,257,258],{"class":78,"line":79},[76,259,260],{"class":82},"# Publisher creates a checksum file\n",[76,262,263,265,268,272],{"class":78,"line":86},[76,264,90],{"class":89},[76,266,267],{"class":93}," release.tar.gz",[76,269,271],{"class":270},"szBVR"," >",[76,273,274],{"class":93}," release.tar.gz.sha256\n",[76,276,277],{"class":78,"line":97},[76,278,107],{"emptyLinePlaceholder":106},[76,280,281],{"class":78,"line":103},[76,282,283],{"class":82},"# User verifies\n",[76,285,286,288,291],{"class":78,"line":110},[76,287,90],{"class":89},[76,289,290],{"class":164}," -c",[76,292,274],{"class":93},[76,294,295],{"class":78,"line":116},[76,296,297],{"class":82},"# Output: release.tar.gz: OK\n",[10,299,301],{"id":300},"which-hash-algorithm-should-you-use","Which Hash Algorithm Should You Use?",[303,304,305,321],"table",{},[306,307,308],"thead",{},[309,310,311,315,318],"tr",{},[312,313,314],"th",{},"Algorithm",[312,316,317],{},"Status",[312,319,320],{},"Use For",[322,323,324,339,351,364],"tbody",{},[309,325,326,333,336],{},[327,328,329],"td",{},[330,331,332],"strong",{},"SHA-256",[327,334,335],{},"Recommended",[327,337,338],{},"All file verification",[309,340,341,346,348],{},[327,342,343],{},[330,344,345],{},"SHA-512",[327,347,335],{},[327,349,350],{},"Large files, extra security margin",[309,352,353,358,361],{},[327,354,355],{},[330,356,357],{},"SHA-1",[327,359,360],{},"Deprecated",[327,362,363],{},"Only if SHA-256 is unavailable",[309,365,366,371,374],{},[327,367,368],{},[330,369,370],{},"MD5",[327,372,373],{},"Broken",[327,375,376],{},"Only for accidental corruption, not tampering",[15,378,379],{},"If you verify against MD5, you are protected against corruption but not against a determined attacker who could craft a collision. SHA-256 or SHA-512 should be your default choice.",[10,381,383],{"id":382},"signed-hashes-and-trust","Signed Hashes and Trust",[15,385,386],{},"A published hash is only as trustworthy as the channel that delivers it. An attacker who compromises the download page could replace both the file and the hash.",[26,388,390],{"id":389},"pgpgpg-signatures","PGP\u002FGPG Signatures",[15,392,393],{},"Many software projects sign their checksums with PGP keys. This adds a layer of trust:",[47,395,397],{"className":70,"code":396,"language":72,"meta":56,"style":56},"# Verify the signature on the checksum file\ngpg --verify SHA256SUMS.gpg SHA256SUMS\n\n# Then verify the file against the signed checksums\nsha256sum -c SHA256SUMS\n",[54,398,399,404,418,422,427],{"__ignoreMap":56},[76,400,401],{"class":78,"line":79},[76,402,403],{"class":82},"# Verify the signature on the checksum file\n",[76,405,406,409,412,415],{"class":78,"line":86},[76,407,408],{"class":89},"gpg",[76,410,411],{"class":164}," --verify",[76,413,414],{"class":93}," SHA256SUMS.gpg",[76,416,417],{"class":93}," SHA256SUMS\n",[76,419,420],{"class":78,"line":97},[76,421,107],{"emptyLinePlaceholder":106},[76,423,424],{"class":78,"line":103},[76,425,426],{"class":82},"# Then verify the file against the signed checksums\n",[76,428,429,431,433],{"class":78,"line":110},[76,430,90],{"class":89},[76,432,290],{"class":164},[76,434,417],{"class":93},[15,436,437],{},"This two-step process ensures that even if the website is compromised, the attacker cannot produce a valid PGP signature without the private key.",[26,439,441],{"id":440},"where-to-find-hashes","Where to Find Hashes",[443,444,445,451,457,463],"ul",{},[34,446,447,450],{},[330,448,449],{},"Official project websites",": Usually on the download page",[34,452,453,456],{},[330,454,455],{},"Release notes",": Hashes for each release artifact",[34,458,459,462],{},[330,460,461],{},"Package managers",": npm, pip, and apt verify hashes automatically",[34,464,465,468,469,472,473,476],{},[330,466,467],{},"Signed manifests",": ",[54,470,471],{},".sha256"," or ",[54,474,475],{},".sha512"," files alongside downloads",[10,478,480],{"id":479},"common-pitfalls","Common Pitfalls",[26,482,484],{"id":483},"wrong-file-version","Wrong File Version",[15,486,487],{},"Make sure the hash you are comparing against matches the exact version you downloaded. A mismatch with a different version's hash is a false alarm.",[26,489,491],{"id":490},"whitespace-in-copied-hashes","Whitespace in Copied Hashes",[15,493,494,495,498],{},"When copying hashes from web pages, trailing whitespace or hidden characters can cause mismatches. Always compare carefully or use the ",[54,496,497],{},"-c"," checksum file method.",[26,500,502],{"id":501},"large-file-verification-takes-time","Large File Verification Takes Time",[15,504,505],{},"SHA-256 verification of a 4 GB ISO file takes 10-30 seconds depending on your disk speed. Do not assume the process has frozen.",[10,507,509],{"id":508},"key-takeaways","Key Takeaways",[443,511,512,515,518,528,531,534],{},[34,513,514],{},"Hash verification confirms your downloaded file matches the publisher's original exactly",[34,516,517],{},"SHA-256 is the recommended algorithm for file verification today",[34,519,520,521,523,524,527],{},"Use ",[54,522,90],{}," on Linux\u002FmacOS and ",[54,525,526],{},"Get-FileHash"," on Windows",[34,529,530],{},"PGP-signed checksums protect against compromised download pages",[34,532,533],{},"MD5 is acceptable for detecting accidental corruption but not malicious tampering",[34,535,536],{},"Always verify the hash matches the correct file version",[10,538,540],{"id":539},"try-it-yourself","Try It Yourself",[15,542,543,544,549],{},"Compute SHA-256, MD5, and SHA-1 hashes for any text instantly with our free ",[545,546,548],"a",{"href":547},"\u002Ftools\u002Fhash-calculator","Hash Calculator",". All processing happens locally in your browser — your data never leaves your device.",[15,551,552],{},[545,553,554],{"href":547},"Try the Hash Calculator →",[556,557,558],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}",{"title":56,"searchDepth":86,"depth":86,"links":560},[561,562,565,570,571,575,580,581],{"id":12,"depth":86,"text":13},{"id":23,"depth":86,"text":24,"children":563},[564],{"id":28,"depth":97,"text":29},{"id":62,"depth":86,"text":63,"children":566},[567,568,569],{"id":66,"depth":97,"text":67},{"id":194,"depth":97,"text":195},{"id":246,"depth":97,"text":247},{"id":300,"depth":86,"text":301},{"id":382,"depth":86,"text":383,"children":572},[573,574],{"id":389,"depth":97,"text":390},{"id":440,"depth":97,"text":441},{"id":479,"depth":86,"text":480,"children":576},[577,578,579],{"id":483,"depth":97,"text":484},{"id":490,"depth":97,"text":491},{"id":501,"depth":97,"text":502},{"id":508,"depth":86,"text":509},{"id":539,"depth":86,"text":540},"2026-05-28","Learn how to verify file integrity using SHA-256 and MD5 hashes. Prevent corrupted or tampered downloads with checksum verification.","md",{"immutable":106},"\u002Fguides\u002Fverifying-file-downloads-hashes",{"title":5,"description":583},"guides\u002Fverifying-file-downloads-hashes","W0O_SEn6LOINAaRnaQxoWC8Bd7ixTgHCAU7kp-OoCGU",1780401338221]