How to check a SHA-256 checksum on Windows, Mac and Linux

Disclosure: I’m Inna Hall, co-founder of TimeBinder^®, the file timestamping tool this guide mentions.

How to check a SHA-256 checksum: the short answer

1. Find the published hash. It’s usually next to the download link, or in a file named something like SHA256SUMS or file.zip.sha256.
2. Hash your copy with the command for your system (below).
3. Compare the two. Every character must match. Upper or lower case doesn’t matter, because it’s the same hexadecimal number written two ways.

Method	Needs an install?	Uploads the file?	Best for
PowerShell Get-FileHash (Windows)	No, built in	No	Windows users comfortable typing one command
certutil -hashfile (Windows)	No, built in	No	Command Prompt and older scripts
shasum -a 256 (Mac)	No, built in	No	Mac users in Terminal
sha256sum (Linux)	Part of GNU coreutils	No	Linux, and checking many files at once
TimeBinder hash checker	No, runs in your browser	No	Anyone who’d rather not use a command line; it also compares two files
Online tools that upload your file	No	Yes	Avoid these for private files

The command-line tools are better for scripts and for checking many files at once. The browser checker is easier if you’re not sure where a file is or how to type its path.

How to check a SHA-256 checksum on Windows

PowerShell: Get-FileHash

1. Open PowerShell (search for it from the Start menu).
2. Go to the folder with your file, for example cd $HOME\Downloads.
3. Run:

Get-FileHash .\file.zip

You don’t need to name the algorithm. Microsoft’s documentation says “The hash algorithm used is the default, SHA256.” If you want to be explicit, add -Algorithm SHA256.

The result shows the algorithm, the hash and the file’s path. In Microsoft’s examples the hash appears in capital letters; that’s normal.

To let PowerShell do the comparison, paste the published hash between the quotes:

(Get-FileHash .\file.zip).Hash -eq "PASTE-THE-PUBLISHED-HASH-HERE"

It prints True if they match and False if they don’t. Case doesn’t matter here: Microsoft says “String comparisons are case-insensitive unless you use the explicit case-sensitive operator.”

Command Prompt: certutil

Microsoft documents the syntax as certutil [options] -hashfile InFile [HashAlgorithm]. Always name the algorithm, so you know which hash you’re getting:

certutil -hashfile file.zip SHA256

If the path has spaces, put it in quotes, for example certutil -hashfile "C:\Users\you\Downloads\my file.zip" SHA256.

How to check a SHA-256 checksum on a Mac

1. Open Terminal (in Applications > Utilities).
2. Type shasum -a 256 with a space at the end, then drag the file from Finder into the Terminal window. Apple’s own instructions use the same drag-in step.
3. Press Return.

shasum -a 256 ~/Downloads/file.zip

You get Apple’s “64-character alphanumeric hash”, then the file name. Here’s the format, from a test file we hashed with the same shasum command (example output):

de09f6db171a7be337e3dd8f2f2b8b1784bea5ae78d5483fdd09314d54633619  example.txt

How to check a SHA-256 checksum on Linux

sha256sum is part of GNU coreutils, according to the GNU coreutils manual:

sha256sum file.zip

Example output from our test file:

de09f6db171a7be337e3dd8f2f2b8b1784bea5ae78d5483fdd09314d54633619  example.txt

The GNU manual describes this format as the checksum, a space, a mode flag (a space or *), and the file name. That’s why you usually see two spaces.

Let sha256sum compare for you

The -c (or --check) option reads a list of hashes and file names and “report[s] whether the checksums match the contents of the named files”, in the GNU manual’s words. If the publisher gives you a SHA256SUMS file, put it in the same folder as the download and run:

sha256sum -c SHA256SUMS

Or check one file against a hash you’ve copied. Note the two spaces before the file name:

echo "PASTE-THE-PUBLISHED-HASH-HERE  file.zip" | sha256sum -c

Example output from our test file, before and after we changed one character in it:

example.txt: OK

example.txt: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

If you see a warning that a listed file couldn’t be read, you may be checking a list that names files you didn’t download. Run the check in the folder where the download is. To run the same kind of check across a whole archive, see how to detect bit rot on ext4.

In your browser, with no upload

If you’d rather not type commands, open TimeBinder’s free SHA-256 hash checker. Paste the published checksum, then pick the file. The hash is worked out on your computer, and the file isn’t uploaded. For the same file, it gives the same 64 characters as the commands above. It can also compare two files directly.

What a matching hash shows, and what it doesn’t

A SHA-256 fingerprint matches only the exact file it was made from. If one byte changes, the hash changes completely.

A match shows that your file is identical to the file the published hash was made from.

A match doesn’t show:

• That the file is safe. If the publisher’s file had malware in it, your identical copy does too.
• Who made the file, or who published it.
• That the hash itself is genuine. A hash is only as trustworthy as the page you got it from. If someone can replace the download, they may be able to replace the hash next to it. For important software, check whether the publisher also offers a digital signature.
• When the file was made. A hash has no date in it.

Going one step further: recording when a file existed

A hash says what a file is, but not when it existed. If you need a dated record of your own files, such as a design, a manuscript, a dataset or a contract draft, a TimeBind records the file’s SHA-256 fingerprint on the Bitcoin blockchain. That shows the file existed no later than the recorded time. Files are hashed in your browser and never uploaded, and you can include up to 10 files in one TimeBind. See how a TimeBind works, and the timestamping glossary for the terms.

There are two ways to TimeBind:

• Pooled (1 Token): Your fingerprint is grouped with other users’ in one shared Bitcoin entry, usually recorded within 24 to 48 hours, and often sooner, depending on Bitcoin network activity. It’s verified through TimeBinder.
• ASAP (3 Tokens): It gets its own Bitcoin transaction, sent straight away, and can be verified independently from the certificate and the Bitcoin blockchain.

The ASAP vs Pooled verification guide explains the difference.

What a TimeBind does NOT do

• It doesn’t show who made the file.
• It doesn’t show the contents are true or safe.
• It doesn’t show whether AI was used.
• It can’t say how a court or anyone else will treat it.

When TimeBinder isn’t the right tool

• You only want to check a download. The built-in commands above, or the free checker, are all you need. There’s nothing to record.
• You need to know who published the software. Check the publisher’s digital signature instead.
• You need to know a file is safe. Use security software. A hash can’t tell you.
• You need to keep a file secret. A hash doesn’t encrypt anything. Keep the file itself protected.

TimeBinder pricing

• Free: $0. The Free plan includes 1 Token every month. No credit card required.
• Essential: $20 a month for 5 Tokens.
• Expert: $50 a month for 15 Tokens.
• Business: $149 a month for 60 Tokens.
• Business Plus: $299 a month for 150 Tokens.
• Enterprise: custom.

A paid plan replaces the Free plan’s Token. A Pooled TimeBind uses 1 Token and an ASAP TimeBind uses 3. Prices are in US dollars. Service terms for every plan are set out in the TimeBinder Terms and Conditions.

TimeBind your files

If you want a dated record of your own files, not just a checksum, TimeBind them. The Free plan includes 1 Token every month, and no credit card is required.

TimeBind your files →   See plans and pricing →