Checksum · verify a download
Compute the SHA-256, MD5 or other checksum of any file — multi-gigabyte ISOs included — and check it against the value the publisher lists. Drop a SHA256SUMS file along with your downloads to check them all at once.
How to verify a download
- Find the checksum on the download page. It is usually a long string of letters and digits labelled SHA-256, or a file such as
SHA256SUMS,checksums.txtorname.iso.sha256. - Drop your downloaded file onto the box above, together with that checksum file, or paste the checksum into the box.
- Green means the file is byte-for-byte the one the publisher hashed. Red means it differs: download it again.
Any size, any number of files
Files are read in pieces and hashed as they stream, in a background worker, so a 10 GB disk image never has to fit in memory and the page stays responsive. Several files are hashed one after another, and each can compute several algorithms in a single pass.
Checksum files it understands
- GNU coreutils format from
sha256sum,sha512sum,sha1sumandmd5sum:<hash> nameor<hash> *name, Windows or Unix line endings. - BSD and macOS format from
shasum --tagoropenssl dgst:SHA256 (name) = <hash>. - Files that hold just the hash, such as
name.iso.sha256, and PGP-signedSHA256SUMSfiles (the checksums are read; the signature itself is not checked here).
What a match does and does not prove
A matching checksum proves the file is exactly the file that was hashed: not truncated, not corrupted, not swapped. It only proves it came from the publisher if the checksum did. Take the checksum from the official website over HTTPS rather than from a mirror, and where the project signs its checksum file, verify that signature too. MD5 and SHA-1 are fine for catching corruption but can be forged deliberately; prefer SHA-256 or longer when it is offered.