How to Verify a Downloaded File's Integrity With Its SHA Hash

You download an operating system ISO image, a software installer from a mirror, or a large file over an unstable connection. In any of these three cases, there's a risk the file arrives corrupted (from a connection that dropped mid-download) or, in the worst scenario, tampered with by someone who intercepted the download. The standard way to check is the SHA hash.

What a hash is and why it works for this

A hash is the result of applying a mathematical function to a file that produces a fixed-length string (for example, SHA-256 always produces 64 hexadecimal characters), and which changes completely if a single bit of the original file is modified. Two files that are identical byte for byte always produce exactly the same hash; any difference, however tiny, produces a completely different hash.

This makes it the perfect way to verify integrity: if the hash you calculate matches the one published by the file's official source, you have mathematical certainty that your copy is identical byte for byte to the original.

How to verify a file's integrity

1. Upload the file you want to verify.
2. The tool calculates its SHA hash.
3. Compare it against the hash published by the official source (usually next to the download link, in a .sha256 file or similar).
4. If they match, the file is identical to the original; if not, something changed along the way.

You can do it free with the file hash checker on this site, which calculates the hash directly in your browser without uploading the file anywhere.

Why this matters beyond "the file wasn't corrupted"

• Incomplete downloads: a connection that drops mid-download can leave a file that looks complete (matching the expected size in some cases) but with corrupted content; the hash detects this immediately.
• Unofficial mirrors: when downloading software from a third-party mirror instead of the original source, verifying the hash confirms the mirror serves exactly the same file, not a modified version.
• Integrity after a transfer: when moving large files between drives or servers, comparing the hash before and after confirms the copy happened without corruption.
• Security verification: software distributed with the official hash published lets you detect if a file was altered (for example, with injected malware) between the original server and your download.

Why the calculation should happen on your own device

A file whose hash you need to verify can be sensitive (licensed software, documents, backups) or simply large. Calculating the hash in your browser, without uploading the file to any external server, is both more private and faster: there's no upload time and no dependence on some other server's speed.

Frequently asked questions

Which algorithm should I use, MD5 or SHA-256? SHA-256 is the currently recommended standard; MD5 and SHA-1 have known cryptographic weaknesses and are no longer considered secure for critical integrity verification, though they remain valid for detecting accidental corruption.

If the hashes don't match, does it mean the file has a virus? Not necessarily; it could simply be an incomplete or corrupted download. It is a signal that you shouldn't trust that file until you download it again and re-verify.

Where do I find a file's official hash? Usually on the same download page, next to the link, or in an additional text file (SHA256SUMS, file.sha256).

Is my file uploaded to any server to calculate the hash? No, the entire calculation happens in your browser.

Verify any file's integrity for free with the file hash checker, 100% in your browser and without uploading the file.