What Is a File Checksum and How Do You Use One?

When you download software from the internet, how do you know the file you received is identical to the file the developer published? It could have been corrupted during transfer by a network error. It could have been modified by a man-in-the-middle attacker. It could have been tampered with on a compromised mirror server. A checksum is the answer to all three of these questions.

What a checksum is

A checksum is a fixed-length string of characters produced by running a file through a cryptographic hash function. The hash function takes the file's binary content: every byte, in order: and produces a deterministic fingerprint. Change a single bit anywhere in the file and the checksum changes completely. This property makes checksums reliable detectors of any modification, whether accidental or deliberate.

The same file will always produce the same checksum using the same algorithm. This means a publisher can compute the checksum of their installer before releasing it, publish that checksum alongside the download link, and you can verify your downloaded copy matches by computing the checksum yourself and comparing the two strings.

Which algorithms are used

• •MD5 (128-bit, 32 hex characters): still widely published by software vendors for checksum purposes, despite being cryptographically broken for security use. For integrity verification it remains functional: collision attacks are theoretical in this context.
• •SHA-1 (160-bit, 40 hex characters): stronger than MD5 but also deprecated for cryptographic security. Still used in legacy systems.
• •SHA-256 (256-bit, 64 hex characters): the current standard for downloads. Used by Linux distributions, security tools, and most modern software publishers.
• •SHA-512 (512-bit, 128 hex characters): more resistant to length-extension attacks, used in high-security contexts.

How to verify a checksum

1. 1.Download the file you want to verify.
2. 2.Find the expected checksum on the publisher's website: usually on the same page as the download link, in a file named something like SHA256SUMS.txt, or in the release notes.
3. 3.Note which algorithm the publisher used (SHA-256, MD5, etc.).
4. 4.Compute the checksum of your downloaded file using a tool: the Checksum Verifier tool, the command line, or your operating system's built-in utilities.
5. 5.Compare the two strings character by character. They should be identical. Even a single character difference means the files do not match.

Computing checksums on the command line

On macOS and Linux, shasum -a 256 filename.iso computes a SHA-256 checksum. md5sum filename.iso computes MD5. On Windows, certutil -hashfile filename.iso SHA256 computes SHA-256. These commands output the checksum directly in the terminal for comparison with the published value.

What a matching checksum proves (and what it does not)

A matching checksum proves that your copy of the file is bit-for-bit identical to the file the checksum was computed from. It does not prove that the original file was safe. If a publisher's server was compromised before the file was published, both the file and the checksum would be malicious but matching. For high-stakes downloads (operating systems, security tools), also verify that the checksum page itself is served over HTTPS and that the publisher's identity is confirmed by checking their signing key if they provide one.

Checksums vs digital signatures

A checksum tells you the file is unchanged. A digital signature tells you the file was produced by a specific private key, which a trusted publisher holds. Major software publishers like Linux distributions provide both: a SHA-256 checksum for quick integrity verification and a GPG-signed checksum file for stronger identity verification. If you are distributing software yourself, providing both is a mark of professionalism.