How to check a download is genuine with SHA-256 (Windows, macOS and Linux)
2026-10-09
When you download software, two things can go wrong: the file can be damaged on the way, or someone can swap it for a modified copy. A SHA-256 checksum catches both. It's a 64-character fingerprint of the file: change a single byte and the fingerprint changes completely.
Where we have one, the SHA-256 checksum is shown on the tool page. Checking it takes less than a minute.
On Windows
1. Open PowerShell (press Start, type PowerShell, press Enter).
2. Type Get-FileHash followed by a space, then drag the downloaded file into the window and press Enter.
3. Compare the Hash line with the checksum on the tool page.
Example: Get-FileHash "$env:USERPROFILE\Downloads\setup.exe"
On macOS
1. Open Terminal (Applications → Utilities).
2. Type shasum -a 256 followed by a space, drag the file in, and press Enter.
On Linux
Run sha256sum ~/Downloads/file-name in a terminal.
What the result means
- The two values match: the file is exactly what was published. It's safe to install, as long as you trust the publisher.
- They don't match: don't run it. Delete the file, download it again from the official tool page, and check again. If it still doesn't match, let us know straight away.
Letters can be upper or lower case — A1B2 and a1b2 are the same. Only the characters matter.
Why Windows may still warn you
A matching checksum proves the file is genuine. It doesn't stop Windows SmartScreen from warning about a new release it hasn't seen many times before. If the checksum matches, click More info → Run anyway.
