How to verify the integrity of a downloaded file

SHA-256 on macOS, Windows and Linux.

Iuri V.

Next to every downloadable file on this site you will find two fingerprints: SHA-256 and MD5. They answer one simple question: is the file on your disk identical to the one that was published, or did it get corrupted along the way or tampered with?

Verifying takes one command and ten seconds. Nothing to install: the tools already ship with all three operating systems.

macOS

shasum -a 256 ~/Downloads/nomefile.dmg

Windows

certutil -hashfile C:\Users\tuonome\Downloads\nomefile.zip SHA256

Linux

sha256sum ~/Downloads/nomefile.AppImage

The command prints a long hexadecimal string. Compare it with the one published on the app page: they must match character for character. A single different character means the file is not the right one.

If the fingerprints do not match

Do not open the file. Delete it.
Download it again: most of the time it was just an interrupted transfer.
If the fingerprint is still different on the second try, email me at [email protected] before running anything.

A note on MD5: it is published only as an extra check against accidental corruption. It is no longer considered safe against deliberate tampering, so the reference for real verification is always SHA-256.