How to check SHA-256 checksum of files
A lot of websites provide pre-computed SHA-256 digests for files that users download. A user can compare the checksum of the file they have downloaded with the checksum provided by the website separately. If the checksums match, it means the file was not tampered with in transit and it is indeed the file the user intended to download. No one wants to download and run an infected executable file that has malicious code.
So how would we check SHA-256 checksum of a file?
Most unix-based operating systems include SHA-2 utilities in their distribution packages and Windows users can use PowerShell function “Get-FileHash” to compute SHA-256 checksums.
Let’s look at some of these commands and examples of using them.
For the examples below let’s assume we want to use KeePass to store our passwords and we have downloaded version 2.52 of the software that comes in the zip file called KeePass-2.52.zip from KeePass website. Now this is kind of software we can’t take our chances with, so we must check the integrity of the file. We should compare the checksum of the file we have downloaded with the one provided by KeePass i.e. 2793D799 F1BB5745 F18739D2 BF162D24 73D006C3 E3DF2A4E 28FBCC1A 0439D6C0 on their integrity page and make sure they are the same.
Linux
On a Linux machine we can use sha256sum .
We can see the value above matches the one on KeePass integrity page so we know we have the trustworthy file and it has not been tampered with. Sometimes it can be hard to check each character by looking at them especially when we have multiple files. Some websites give us the checksum in a DIGEST file so we can verify them easily and automatically. DIGEST file is a text file containing names of files and their respective checksums. Assuming we have a DIGEST file called KeePass-2.52.zip.DIGEST in the same directory as the zip file then we can verify the file using:
-c or —check option reads the checksums and filenames in the DIGEST file. It then computes the checksums of the files and compares them checksums in the digest file. If they match it prints OK and if they don’t match it will show which files failed.
MacOS
On MacOS we can use the following command to compute the SHA-256 checksum for the file.
-a or —algorithm option is used to specify which version of Secure Hash Algorithms (SHA) we want to use.
We can also use shasum to verify using DIGEST files.
OpenSSL
Regardless of which operating system we use if we have openssl installed then it can also be used to compute SHA-256 checksums.
Windows
On Windows we can either use certUtil or PowerShell function Get-FileHash to compute SHA-256 checksum for the file.
HowToSHA256SUM
The program sha256sum is designed to verify data integrity using the SHA-256 (SHA-2 family with a digest length of 256 bits). SHA-256 hashes used properly can confirm both file integrity and authenticity. SHA-256 serves a similar purpose to a prior algorithm recommended by Ubuntu, MD5, but is less vulnerable to attack.
Comparing hashes makes it possible to detect changes in files that would cause errors. The possibility of changes (errors) is proportional to the size of the file; the possibility of errors increase as the file becomes larger. It is a very good idea to run an SHA-256 hash comparison check when you have a file like an operating system install CD that has to be 100% correct.
In terms of security, cryptographic hashes such as SHA-256 allow for authentication of data obtained from insecure mirrors. The SHA-256 hash must be signed or come from a secure source (such as a HTTPS page or a GPG-signed file) of an organization you trust. See the SHA-256 checksum file for the release you’re using under http://releases.ubuntu.com, such as http://cdimage.ubuntu.com/daily-live/current/SHA256SUMS . You should verify this file using the PGP signature, SHA256SUMS.gpg (such as http://cdimage.ubuntu.com/daily-live/current/SHA256SUMS.gpg ) as described in VerifyIsoHowto.
sha256
sha256sum on Linux
Most Linux distributions come with the sha256sum utility (on Ubuntu it is part of the coreutils package). We are going to use the Ubuntu 9.10 LiveDVD for the following example:
Check the iso file
Ubuntu distributes the SHA-256 checksum hashes in a file called SHA256SUMS in the same directory listing as the download page for your release http://releases.ubuntu.com.
Manual method
First open a terminal and go to the correct directory to check a downloaded iso file:
Then run the following command from within the download directory.
sha256sum should then print out a single line after calculating the hash:
Compare the hash (the alphanumeric string on left) that your machine calculated with the corresponding hash in the SHA256SUMS file.
When both hashes match exactly then the downloaded file is almost certainly intact. If the hashes do not match, then there was a problem with either the download or a problem with the server. You should download the file again from either the same mirror, or from a different mirror if you suspect a server error. If you continuously receive an erroneous file from a server, please be kind and notify the web-master of that mirror so they can investigate the issue.
Semi-automatic method
First download the SHA256SUMS and SHA256SUMS.gpg files to the same directory as the iso. Then run the following commands in a terminal.
The sha256sum line should output a line such as:
If the OK for your file appears, that indicates the hash matches.
Success
Once you have verified the sha256 hash, go ahead and burn the CD. You may want to refer to the BurningIsoHowto page.
Check the CD
So far so good, you have downloaded an iso and verified its integrity. When you boot from the CD you will be given the option to test its integrity. Great, but if the CD is corrupt then you have already wasted time rebooting. You can check the integrity of the CD without rebooting as follows.
Manual method
Check the calculated hash against UbuntuHashes as shown for the iso file above. Depending on your system, you may need to change cdrom to cdrom0 (or even cdrom1 if you have two CD drives).
Success?
Congratulations, you now have a verified Ubuntu CD. Go ahead and use it (or play frisbee with it if you want).
MD5SUM on Mac OS X
This should be updated by someone with access to a Mac.
There are three methods of using md5sumsum on an OS X machine.
Method 1 — The easiest (if MD5 is available) is using the Disk Utility program (Applications > Utilities, or by choosing "Utilities" from the Finder’s "Go" menu). Open Disk Utility and wait for it to gather information about your disks. Go to the directory where you downloaded the Ubuntu disk image, and drag it to Disk Utility’s dock icon (displays on the left-hand side of Disk Utility, underneath your physical drives). Select the iso file. Go to the "Images" menu and select Checksum > MD5. Be sure to choose "MD5" and NOT "MD5 image checksum" or "CRC-32 image checksum", as they are not the same and will give you different results.
Method 2 — If MD5 is not available in the Images > Checksum menu, open a terminal window (Applications > Utilities > Terminal.app). Type "md5", type a space, drag the iso file into the terminal window (appends command with iso file path), and press Enter. The command line returns the hash number.
Method 3 — You can use the Terminal.app and follow the instructions for SHA256SUM on Linux, except use the command "openssl md5" instead of "sha256sum".
Each method returns a hash number. Compare the hash number with the corresponding hash on the UbuntuHashes page. When both hashes match exactly, then the downloaded file is almost certainly intact.
If the hashes do not match, then there was a problem with either the download or a problem with the server. You should download the file again from either the same mirror, or from a different mirror if you suspect a server error. If you continuously receive an erroneous file from a server, please notify the web-master of that mirror so they can investigate the issue.
digest(1) on Solaris
Use the Solaris digest(1) command, specifying the sha256 algorithm with the -a flag. For instance:
SHA256SUM on Windows
This section also needs to be updated. Is there a sha256sum.exe file distributed by a reliable source? Is there a good GUI?
Windows does not come with sha256sum. You must download one from another location, preferably one that you trust. There are command line utilities that work similarly to the Unix utility; one public domain version with source is available from Fourmilab, but the version available from Cygwin is probably easier to install and update, and Cygwin is also recommended and trusted as the source for many more Unixy utilities. Once installed, Cygwin’s sha256sum behaves exactly as described in SHA256SUM on Linux above.
Как проверить SHA256 хеш-сумму файла в Windows
Очень часто, при скачивании различных дистрибутивов/программ/кошельков, возникает необходимость проверить SHA256 хеш-сумму скачанного файла/архива, чтобы достоверно убедиться, что это именно тот файл, который нужен и он не был модифицирован злоумышленниками. В данной статье будут рассмотрены несколько способов это сделать на ОС семейства Windows.
Вариант через расширение для проводника
Существует бесплатное приложение, которое позволяет интегрировать в проводник Windows такой функционал. Называется оно Hashtab, данное приложение бесплатно для некоммерческого использования и вы без проблем можете скачать его с официального сайта: http://implbits.com/products/hashtab/
Для этого, выбираем бесплатную версию (Free) и жмем на кнопку Download.
После установки программы, в контекстном меню проводника появится новая вкладка «Хеш-суммы файлов», выбрав которую, программа автоматически посчитает хеш-суммы для выбранного файла в зависимости от того, какие алгоритмы выбраны в ее настройках.
Чтобы посчитать SHA-256, необходимо выбрать нужный файл (хеш сумму которого мы будет считать), нажать правой кнопкой мышки и выбрать пункт «Свойства».
Далее необходимо выбрать пункт «Настройки».
В настройках необходимо отметить галочкой алгоритм SHA-256 и нажать на кнопку «ОК»
После чего, на данной вкладке можно будет посмотреть SHA-256 Хеш-сумму выделенного файла.
Вариант с использованием архиватора 7-Zip
Бесплатный архиватор 7-Zip тоже умеет считать SHA256 сумму файлов. Для этого достаточно либо в окне программы (в том числе и портативной версии), либо просто нажать правой кнопкой по файлу, и в контекстном меню выбрать пункт «CRC SHA — SHA256» (только при установленном в системе архиваторе 7-Zip).
Скачать 7-Zip можно с его официального сайта — https://www.7-zip.org
Вариант через командную строку (без установки программ)
В том случае, если вам удобнее пользоваться командной строкой или же вы настраиваете какой-либо скрипт на автоматическую проверку SHA-256 в Windows, то вы можете воспользоваться утилитой CertUtil.
Для проверки SHA-256 хеша, достаточно ввести следующую команду:
C:\Users\Admin\Downloads\HashTab_v6.0.0.34_Setup.exe — это путь к тому файлу, хеш-сумму которого мы хотим посчитать. 
Как видно на скриншоте, хеш-сумма нашего файла 85caa9ea0b. полностью идентична той, которую мы получили с помощью первого способа.
Rublon Help
After downloading a file from our site, you may want to verify its SHA-256 checksum to ensure the downloaded file’s integrity.
What is an SHA-256 checksum?
You can think of a checksum as a fingerprint of a file.
Here’s an example of a checksum:
Every file has a unique checksum that you can use to ensure its integrity. In other words, you can verify the file’s checksum to ensure the file you downloaded is exactly the file you want and that it was not corrupted or modified in any way.
SHA-256 is a name for one of the hash algorithms you can use to generate a checksum.
What You Need To Remember
There are two things you need to remember while generating checksums of our files:
All checksums in Rublon Downloads are generated using the SHA-256 algorithm. If you use a different algorithm to generate your checksum, e.g. SHA 1, it will produce a different result. Always generate an SHA-256 checksum.
- For checksums, capitalization does not matter, e.g. A and a are the same. These two strings are the same checksum:
F7EFD7168F50FD6B574C1D948779AC1CC3D70AFCC95C5757FF82F57BFA06B194
f7efd7168f50fd6b574c1d948779ac1cc3d70afcc95c5757ff82f57bfa06b194
How to verify an SHA-256 checksum?
To verify the SHA-256 checksum of a file, you must generate a checksum of the downloaded file and compare it to the checksum in Rublon Downloads .
Find the instructions below to learn how to generate a checksum of a file on your operating system.
Windows
You can use Command Prompt or PowerShell to generate an SHA-256 checksum on Windows.
Using Command Prompt
1. Press Windows+R to open the Run box
2. Type cmd and click OK .
3. The Command Prompt window will open.
4. Run the following command:
certutil -hashfile C:\file\path\my_file.exe SHA256
Make sure to replace C:\file\path\my_file.exe with the actual path to the file.
5. Compare the generated value to the checksum of the file in Rublon Downloads .
Using Power Shell
1. Press Windows+R to open the Run box
2. Type powershell and click OK .
3. The Windows PowerShell window will open.
4. Run the following command:
Get-FileHash C:\file\path\my_file.exe -Algorithm SHA256
Make sure to replace C:\file\path\my_file.exe with the actual path to the file
5. Compare the generated value to the checksum of the file in Rublon Downloads .
Linux
Every Linux distribution comes with tools for various checksum algorithms. SHA-256 checksum tool is called sha256sum .
1. Go to the directory where your downloaded file is stored, e.g.:
2. Use the following command to generate the checksum:
Make sure to replace my_file.exe with the actual name of the file.
3. Compare the generated value to the checksum of the file in Rublon Downloads .
macOS
1. Click the Launchpad icon in the Dock , type Terminal in the search field, then click Terminal .
2. Use the following command to generate the checksum:
shasum -a 256 /file/path/my_file.exe
Make sure to replace /file/path/my_file.exe with the actual path to the file
3. Compare the generated value to the checksum of the file in Rublon Downloads .