Verify a Downloaded File with SHA-256 on Windows and Linux

A SHA-256 digest can help detect whether a downloaded file differs from a reference value. It does not, by itself, prove who created the file. The reference digest must come from a source you trust independently of the download.

Calculate the digest

In PowerShell, use the built-in command:

Get-FileHash .\installer.exe -Algorithm SHA256

On Linux, use:

sha256sum ./installer

Replace the example path with the file you downloaded. PowerShell documents Get-FileHash; on Linux, check the local sha256sum manual if the utility differs.

Compare the complete value

Compare every hexadecimal character, ignoring letter case but not missing or extra characters. If the vendor signs a checksum file, verify the signature with the vendor's documented key and process. A checksum hosted on the same compromised mirror as a malicious file can be changed alongside it.

Understand what a match tells you

A matching digest indicates that the file you checked matches the bytes represented by the reference digest. It does not certify that the program is safe, bug-free or appropriate for your system. Check the publisher, release, operating-system compatibility and official installation instructions too.

Keep the original file until you have completed verification and any approved malware scanning. If the digest differs, do not run the file; download again from the verified source and contact the publisher if the mismatch persists.