If someone were to compromise that download site and upload a malicious version of the software, unsuspecting users might click a download link and get the compromised download. In an ideal world, this means I have downloaded the expected file exactly, and I didn't end up downloading some compromised file or malware instead.įor example, if some software is made available from a download site to reduce their own bandwidth costs, they might build new releases to a ZIP file and upload them there for users to download. Why would I need a file hash?Īs I mentioned, I usually do this to confirm a file I downloaded matches what the site said it should be when I clicked the download link. Otherwise, I hope these commands find us all when you need them. If you want to learn a little more about the use of hashing files, feel free to read on for some context. Sha256sum ~/Downloads/some-file.zip Background

I've only confirmed this on a few flavors of Ubuntu and Debian/Raspbian. Get-FileHash -Path ~/Downloads/some-file.zip -Algorithm SHA256 Linux Shasum -algorithm 256 ~/Downloads/some-file.zip Windows (cmd.exe)ĬertUtil -hashfile ~/Downloads/some-file.zip SHA256 Windows (PowerShell)Ĭonfirmed in v6.1.3, but it probably works in several earlier versions. For the occasional one-off hash needs, though, they get the job done. As well, there may be ways that are better suited for certain tasks like scripting or other automation steps. There are bound to be other ways to do this, and on more operating systems or command line shells. Instead of wading through a bunch of Stack Overflow answers to find the exact magic command I need, I'm hoping I'll start finding my own blog post in my search results. If it helps you, great! I just keep looking this up every time I need it. While it doesn't guarantee a download hasn't been compromised, sometimes you feel better knowing the file you downloaded matches the expected SHA hash checksum.įull disclosure here: while I haven't been paid or provided anything for this blog post, I am only creating this post for me.

Sha256 checksum mac