Verify a SHA-256 Checksum on Windows

What a checksum proves, and what it does not

A SHA-256 checksum is a fixed-length fingerprint of a file's bytes. If the download was corrupted in transit, the fingerprint changes and the comparison fails. For the general workflow, see how to verify file integrity with SHA-256. For the general workflow beyond Windows, see how to verify file integrity with SHA-256.

It does not prove who published the file. An attacker who can replace the download can usually replace the checksum on the same page. For that, you need a signature or a trusted channel.

Use checksums to catch corruption and casual tampering; use Authenticode or a detached signature when you need to verify the publisher.

The PowerShell way: Get-FileHash

1. Open PowerShell. Windows PowerShell 5.1 and PowerShell 7 both include the command.
2. Run: Get-FileHash .\installer.exe -Algorithm SHA256
3. Copy the Hash value. Compare it with the publisher's value; case does not matter, but every character does.
4. For a quick equality check: (Get-FileHash .\installer.exe -Algorithm SHA256).Hash -eq 'PASTE_THE_EXPECTED_HASH'

Reading the publisher's checksum format

Publishers use three common shapes: a bare 64-character hex digest, a line like <hash> installer.exe, or a .sha256 file that contains one or more such lines.

The double space between the hash and the filename is deliberate in the coreutils format; a single space is common too. Strip whitespace and compare only the digest. For ISO downloads, see verify downloaded ISO checksums.

• Bare hash: compare 64 hex characters, case-insensitive.
• SHA256SUMS: find the line for your exact filename, then compare its first field.
• .sha256 file: the first field is the digest; the rest is the filename.

Compare the digest without fooling yourself

Most false mismatches are copy errors: a truncated hash, a missing character, a line break, or the wrong algorithm. Normalize before you conclude that the file is bad.

• Trim spaces and line breaks from both values.
• Compare lowercase to lowercase; hex is case-insensitive.
• Make sure both sides are SHA-256, not SHA-1 or MD5.
• Check that the expected hash belongs to this exact version and filename.

The fallback: certutil

On older Windows builds, certutil -hashfile .\installer.exe SHA256 prints the digest. It works, but the output includes labels and line breaks, so it is easier to misread.

Prefer Get-FileHash in scripts; it returns an object with a Hash property that can be compared directly.

If the hash matches, are you done?

A matching checksum means the bytes match the publisher's fingerprint. It does not mean the publisher is trustworthy, the file is free of malware, or the version is the one you intended to install.

For signed Windows software, also run Get-AuthenticodeSignature .\installer.exe and check the status and signer. For open-source projects, compare the hash from a second channel when the stakes are high. ISO downloads follow the same steps, with the publisher-specific checks in verify downloaded ISO checksums.

If the hash does not match, delete the download and fetch it again from the official source. Do not fix the hash or ignore a mismatch because the file still opens.

FAQ

References

• Microsoft Learn - Get-FileHash: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash
• NIST FIPS 180-4 - Secure Hash Standard: https://csrc.nist.gov/pubs/fips/180-4/upd1/final
• RFC 6234 - US Secure Hash Algorithms: https://www.rfc-editor.org/rfc/rfc6234
• Microsoft Learn - Get-AuthenticodeSignature: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature