How to verify a download
- Find the official checksumPublishers list it next to the download link, often labelled SHA256 or "checksum".
- Paste it into Expected hashThe algorithm is detected from the length.
- Drop the downloaded fileYou get a clear Match or Mismatch within seconds.
What a mismatch means
A different hash means a different file.
Most often the download was interrupted or corrupted - download it again. If it still differs, the file may have been replaced on a mirror or modified by malware. Do not run it.
Recognise a hash by its length
| Algorithm | Hex characters | Use for verification |
|---|---|---|
| MD5 | 32 | Corruption only - not tamper-proof |
| SHA-1 | 40 | Corruption only - not tamper-proof |
| SHA-256 | 64 | Yes - the standard choice |
| SHA-512 | 128 | Yes |
Rescue disks such as the Kaspersky Rescue Disk are a good example: always verify the ISO before writing it to a USB stick.
Frequently asked questions
Why should I verify a file hash?
The publisher's checksum proves that the file you downloaded is exactly the file they released. If even one byte differs - a corrupted download or a tampered installer - the hash is completely different.
Is my file uploaded?
No. The file is read in chunks and hashed inside your browser. It never leaves your computer, so this works for private files and for multi-gigabyte ISO images.
How do I check a file hash in Windows without a website?
Open PowerShell and run Get-FileHash .\file.iso -Algorithm SHA256, or in Command Prompt certutil -hashfile file.iso SHA256. On macOS and Linux use shasum -a 256 file.iso.
Which algorithm should I compare?
Whichever the publisher lists - usually SHA-256. Paste their value into the "Expected hash" box and the tool detects the algorithm from its length.
The hash matches. Is the file safe?
It is the genuine file from the publisher - but that only helps if the publisher is trustworthy. To check for known malware, use the Online Virus Scanner.