How to Verify File Integrity After Download (Checksum Guide)
Verify file integrity using MD5, SHA-256, and SHA-512 checksums on Windows, macOS, and Linux. Command-line examples and pre-hashed sample files for immediate testing.
Whenever you download software binaries, disk images, or confidential documents, comparing the file checksum against the publisher's published digest confirms that the file was not altered in transit or corrupted by network dropouts.
Command-Line Checksum Tools Across Platforms
Every major operating system provides built-in tools to calculate and verify hashes.
1. macOS (Terminal)
# Compute SHA-256
shasum -a 256 sample-10mb.pdf
# Compute MD5
md5 sample-10mb.pdf
2. Linux (Ubuntu, Debian, RedHat)
# Compute SHA-256
sha256sum sample-10mb.pdf
# Verify against a checksums.txt file
sha256sum -c checksums.txt
3. Windows (PowerShell)
# Compute SHA-256
Get-FileHash .\sample-10mb.pdf -Algorithm SHA256
# Compute MD5
Get-FileHash .\sample-10mb.pdf -Algorithm MD5
Download our 1MB PDF sample and verify its SHA-256 checksum in your terminal right now.
Download 1MB PDF Sample →Automating Checksum Verification in Node.js
import fs from 'fs';
import crypto from 'crypto';
export async function verifyDownloadedFile(
filePath: string,
expectedChecksum: string,
algorithm = 'sha256'
): Promise<boolean> {
const hash = crypto.createHash(algorithm);
const stream = fs.createReadStream(filePath);
for await (const chunk of stream) {
hash.update(chunk);
}
const actualChecksum = hash.digest('hex').toLowerCase();
const matches = actualChecksum === expectedChecksum.toLowerCase();
if (!matches) {
console.error(`Integrity mismatch! Expected: ${expectedChecksum}, got: ${actualChecksum}`);
}
return matches;
}
Why Verify Over HTTPS?
While TLS encrypts data in flight, a compromised content distribution network, faulty proxy cache, or interrupted connection can result in truncated or malicious payloads. Publishing SHA-256 digests out-of-band guarantees end-to-end authenticity.
Nguyen Dai Long
AuthorBackend Lead • Distributed Systems & Cloud Edge Architecture Specialist
4+ years designing high-throughput file ingestion pipelines, database architectures, and distributed edge storage on Cloudflare R2 & AWS S3. Founder of FileDummy and the NDL Ecosystem.
Was this article helpful?
Click Like to support the author and help other developers discover this guide.
Engineering Discussion & Feedback (0)
Share benchmark results, report edge cases, or ask technical questions.
No comments yet. Be the first developer to start the discussion!
Frequently Asked Questions
What command verifies a SHA-256 checksum on macOS?â–¾
Run shasum -a 256 filename.pdf in Terminal. On Linux use sha256sum filename.pdf. On Windows PowerShell use Get-FileHash filename.pdf -Algorithm SHA256.
Why does my downloaded file have a different checksum?â–¾
Common causes: incomplete download, file modified in transit (rare on HTTPS), or comparing against the wrong algorithm. MD5 and SHA-256 produce completely different outputs for the same file.
Is HTTPS enough, or do I still need checksum verification?â–¾
HTTPS protects the file in transit. Checksum verification also protects against a compromised origin server serving a modified file. For security-sensitive downloads, verify checksums even over HTTPS.