How to Check the SHA-256 Hash of a File (Windows, Mac, Linux)

To check the SHA-256 hash of a file, run certutil -hashfile "file.iso" SHA256 in Windows Command Prompt, shasum -a 256 file.iso on a Mac, or sha256sum file.iso on Linux. Then compare the 64-character result with the hash published by whoever made the file. If they match exactly, the file is the one they released. For a quick check without the command line, choose the file in our SHA-256 hash generator; it calculates the hash in your browser, without uploading the file.

What a SHA-256 hash is (and why you check it)

A hash function turns any data, from a single word to a 5 GB file, into a fixed-length fingerprint. SHA-256 produces 256 bits, written as 64 hexadecimal characters, for example:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (the hash of empty input)

Three properties make it useful:

• Same input, same hash, every time, on every computer.
• Any change, completely different hash. Changing one byte of a file changes the hash beyond recognition.
• One-way. You cannot work backwards from a hash to the file.

So if a software site publishes the SHA-256 of its installer and your downloaded copy has the same hash, your copy is byte-for-byte identical: not corrupted, not swapped.

How to check SHA-256 on Windows

certutil (Command Prompt)

1. Open Command Prompt (search for "cmd").
2. Run: certutil -hashfile "C:\Users\you\Downloads\file.iso" SHA256
3. The hash is printed on the second line.

Tip: type certutil -hashfile and then drag the file into the window to paste its path.

PowerShell

Get-FileHash "C:\Users\you\Downloads\file.iso"

Get-FileHash uses SHA-256 by default; add -Algorithm SHA512 (or SHA1, SHA384) for others. To compare automatically:

(Get-FileHash .\file.iso).Hash -eq "PASTE_EXPECTED_HASH"

This prints True or False. PowerShell's -eq ignores case, so upper and lowercase hashes compare correctly.

How to check SHA-256 on Mac

Open Terminal and run:

shasum -a 256 ~/Downloads/file.dmg

To compare in one step, put the expected hash and the file name in this form (two spaces between them):

echo "EXPECTED_HASH file.dmg" | shasum -a 256 -c

It prints file.dmg: OK if they match.

How to check SHA-256 on Linux

sha256sum file.iso

Many projects publish a checksum file (often SHA256SUMS or file.iso.sha256). Put it in the same folder as the download and run:

sha256sum -c SHA256SUMS

Each listed file shows OK or FAILED. Add --ignore-missing if the checksum file lists files you did not download.

Check a file's hash in your browser

1. Open the SHA-256 hash generator.
2. Choose SHA-256 (SHA-1, SHA-384 and SHA-512 are also available).
3. Drop the file onto the "Or hash a file" area.
4. Copy the hash and compare it with the published one.

The file is read and hashed on your device using the browser's built-in Web Crypto; it is not uploaded. The whole file is loaded into memory to do this, so for very large files (several gigabytes, like some disk images) the command-line methods above are more reliable.

How to compare hashes without mistakes

• Compare the whole string, not just the first and last few characters. Paste both into a text editor one above the other, or use the automatic comparison commands above.
• Ignore case. A1B2... and a1b2... are the same hash.
• Check the algorithm. A 40-character hash is SHA-1, 64 is SHA-256, 96 is SHA-384, 128 is SHA-512, and 32 is usually MD5. Hashing with the wrong algorithm always gives a mismatch.

What a mismatch means

If the hashes differ:

1. Re-download the file. An interrupted or corrupted download is the usual cause.
2. Check you are comparing the right file and version. Sites list different hashes for each version and platform.
3. If it still does not match, do not run the file. It may have been tampered with.

Where the hash comes from matters

A hash only proves your file matches the published hash. If an attacker can change both the download and the hash on the same page, the check proves nothing. Prefer hashes from the official site over HTTPS, and where a project offers signed checksums (for example with GPG), verifying the signature is stronger still.

Hashing text, and why your hash is different

Our tool also hashes text as you type. Common reasons a text hash does not match someone else's:

• A trailing newline. echo "hello" | sha256sum hashes "hello" plus a newline. Use echo -n "hello" | sha256sum to hash just the word.
• Different encoding or line endings. Windows uses two characters for a line break; Linux uses one.
• Extra spaces copied at the start or end.

Can SHA-256 be decrypted?

No. Hashing is not encryption; there is no key and no way to reverse it. Websites offering to "decrypt" or "decode" SHA-256 simply keep huge tables of hashes of common words and leaked passwords. If your input is in their table, they find it; otherwise they cannot.

That is also why plain SHA-256 is not suitable for storing passwords. It is designed to be fast, so attackers can test billions of guesses. Password storage should use a slow, salted algorithm like bcrypt or Argon2. A salt is a random value added to each password before hashing so identical passwords get different hashes. For creating strong passwords themselves, use the password generator and see our guide to password length.

SHA-256 vs SHA-1 and MD5

MD5 and SHA-1 are older and are considered broken for security: researchers can create two different files with the same hash. They are still fine for detecting accidental corruption, but use SHA-256 or stronger to detect tampering.

Hashes are sometimes shown in Base64 rather than hex (for example in Subresource Integrity attributes like sha256-...). It is the same value in a different alphabet; Base64 encode/decode explains the encoding.

Common mistakes

• Comparing only the first few characters.
• Using a hash from an unofficial mirror to check a file from that same mirror.
• Hashing text with a hidden newline and thinking the tool is wrong.
• Believing a SHA-256 "decoder" can reverse any hash.

Questions