How to Verify Checksums

Who This Guide Is For

Checksums (hash values) let you verify that a downloaded file matches the official version published by the developer. This guide teaches you how to compute and compare checksums on Windows using built-in PowerShell commands. It's a critical skill for anyone downloading security software, encryption tools, or any executable from the internet.

What Is a Checksum?

A checksum is a unique fingerprint of a file. If even one byte changes, the checksum changes completely. Software developers publish official checksums (usually SHA-256 hashes) on their websites. After downloading a file, you compute its checksum and compare it to the published value. If they match, the file is authentic and unmodified. If they don't match, the file was tampered with or corrupted.

Step-by-Step: Verify a Checksum on Windows

Step 1: Find the Official Checksum

Download the file from the official website and locate the published checksum. Look for pages titled "Checksums," "Verify Downloads," or "SHA-256 Hashes." Developers often publish checksums on their download page, in release notes, or in a separate text file.

Example: VeraCrypt publishes SHA-256 hashes on their official download page for each installer.

Step 2: Compute the Checksum Using PowerShell

Windows includes a built-in command to compute checksums. Open PowerShell and run:

Get-FileHash -Algorithm SHA256 "C:\Users\YourName\Downloads\VeraCrypt_Setup_1.26.7.exe"

Replace the file path with the actual location of your downloaded file. PowerShell will output the SHA-256 hash.

Step 3: Compare the Checksums

Copy the hash from PowerShell and compare it character-by-character to the published hash on the developer's website. They must match exactly. Even one character difference means the file is compromised or corrupted.

Real-World Example: Verifying VeraCrypt

Let's say you downloaded VeraCrypt_Setup_1.26.7.exe. The official VeraCrypt website lists:

SHA-256: 6c8b1c3f8a2e9b4d7f3e1a5c8d9b2f4e6a7c8d9e1f2a3b4c5d6e7f8a9b0c1d2

You compute the hash using PowerShell:

Get-FileHash -Algorithm SHA256 "C:\Users\Jamie\Downloads\VeraCrypt_Setup_1.26.7.exe"

PowerShell outputs:

Algorithm       Hash
---------       ----
SHA256          6c8b1c3f8a2e9b4d7f3e1a5c8d9b2f4e6a7c8d9e1f2a3b4c5d6e7f8a9b0c1d2

The hashes match. The file is authentic. Proceed with installation.

If the hash were different (even by one character), do not install. Delete the file and re-download from the official website.

Common Mistakes in the Real World

Mistake 1: Skipping Verification

Most people skip checksum verification because it feels like extra work. For critical software (encryption tools, security utilities, system drivers), this laziness can cost you. Make verification a habit.

Mistake 2: Comparing Checksums from the Wrong Source

If you download a file from a mirror site and also get the checksum from that same mirror, you've verified nothing—a compromised mirror can publish fake checksums. Always get the checksum from the official website, even if you download from a mirror.

Mistake 3: Ignoring Mismatches

If checksums don't match, some people assume "maybe the developer updated the file." No. A mismatch means the file is wrong. Delete it and investigate. Don't rationalize your way into installing compromised software.

Mistake 4: Not Verifying HTTPS

Checksums protect against tampered downloads, but only if you get the checksum securely. Always verify that you're on the official website (check the HTTPS padlock and domain name). If an attacker controls the download page, they can publish fake checksums.

Advanced: GPG Signature Verification

Some developers publish GPG signatures instead of (or in addition to) checksums. GPG signatures provide stronger assurance because they cryptographically prove the file was signed by the developer's private key. Verifying signatures requires GPG software and importing the developer's public key. This is more complex but offers better security.

For most users, SHA-256 checksum verification is sufficient. If you're interested in GPG, consult the developer's documentation for their public key and signature verification instructions.

Verification Checklist

Frequently Asked Questions