How to Verify File Integrity Using SHA-256 and MD5 Checksums

Updated: November 12, 2026 • 6 min read •
4.9 (215)
Technical Specifications & Compatibility
Supported Algorithms SHA-256 (Secure Standard), SHA-1, MD5 (Legacy)
Native Tools Windows CertUtil, PowerShell Get-FileHash, Linux sha256sum / md5sum
Gui Utilities HashCheck, 7-Zip (CRC SHA menu), QuickHash-GUI
Security Level SHA-256 is cryptographically collision-resistant; MD5 is legacy for quick integrity checks
Table of Contents

Whenever you download system installers, disk images, or compressed firmware backups from cloud repositories, verifying that the file arrived in an uncorrupted and untampered state is standard security hygiene. Cryptographic checksums (specifically SHA-256) act as a digital fingerprint that guarantees 100% data fidelity.

1. What Is a Cryptographic Checksum?

A hash function processes file data through an algorithm to generate a unique string of hexadecimal characters:

  • Deterministic: The exact same file will always generate the exact same hash, regardless of when or where it is calculated.
  • Avalanche Effect: Altering even a single bit (from 0 to 1) in a 10 GB archive alters more than 50% of the resulting hash string.
  • Integrity Guarantee: Comparing your locally computed hash against the publisher's posted checksum proves the file was not modified by network glitches or malicious actors.

2. Checking Hashes in Windows with CertUtil (Zero Installation)

Windows includes the native command-line utility CertUtil by default:

  1. Press Win + R, type cmd, and press Enter.
  2. Run the following command:
certutil -hashfile "C:\path\to\your\file.rar" SHA256
  1. The system computes the hash and displays:
SHA256 hash of C:\path\to\your\file.rar:
a8f5c3b7e9d2... (64-character hexadecimal string)
CertUtil: -hashfile command completed successfully.
  1. Compare this string with the checksum provided on the download page.

3. Checking Hashes in Windows with PowerShell

PowerShell offers an even cleaner method:

Get-FileHash -Algorithm SHA256 "C:\path\to\file.iso"

To automatically compare two hashes:

(Get-FileHash -Algorithm SHA256 "file.iso").Hash -eq "EXPECTED_HASH_HERE"

If it returns True, the file is 100% genuine and uncorrupted.

4. Checking Hashes in Linux & macOS

Open your terminal and run:

# For SHA-256:
sha256sum filename.tar.gz

# For MD5:
md5sum filename.tar.gz

Troubleshooting Common Issues

Error / Issue Technical Cause Step-by-Step Fix
Generated Hash Does Not Match the Provided Checksum The file was modified, corrupted during transit, or infected by malware. Do not execute or open the file. Delete it immediately and re-download from the verified source.
CertUtil Command Returns 'Access is Denied Attempting to calculate hash on a file locked by another running process or inside a protected directory. Move the file to a user directory (like Downloads) or open PowerShell/Terminal with standard privileges.

Frequently Asked Questions

What is a cryptographic hash checksum?

A hash is a fixed-length mathematical fingerprint of a file. If even a single byte in the file changes, the resulting hash completely changes.

Which hash algorithm should I use: MD5 or SHA-256?

Always prefer SHA-256. MD5 is outdated and vulnerable to collisions, while SHA-256 offers military-grade cryptographic certainty.

Does checking a file hash require an internet connection?

No. Hash calculations are performed entirely offline on your local computer using mathematical hashing functions.

Related Technical Guides