How to verify a Windows download with a SHA-256 checksum

A download finishes, and the publisher's page shows a long value labelled SHA-256. That value gives you something precise to compare with the file on your PC.

On Windows 10 or 11, use Get-FileHash in Windows PowerShell to calculate the file's checksum, then compare it with the publisher's value for that exact download. A match is an integrity check against that reference. You still need to trust the publisher and decide whether to run the software.

Find the right expected checksum first

Start from the software publisher's official download or release page. Look for a SHA-256 value, a file ending in .sha256, or a checksum list that includes the download's filename.

Match the release number, operating system, architecture and package type. A Windows 64-bit installer and a portable ZIP can contain related software while being different files. Their checksums are not interchangeable.

For example, VideoLAN's VLC 3.0.20 Windows 64-bit directory lists separate packages and checksum files:

The EXE checksum file gives this SHA-256 value:

d8055b6643651ca5b9ad58c438692a481483657f3f31624cdfa68b92e8394a57

That value belongs specifically to the named EXE. Use the corresponding publisher value when checking another file or release.

If a checksum line also contains a filename, copy only the hexadecimal value for the comparison below. Do not include the filename or the * that some checksum files place before it.

Calculate the download's SHA-256 in Windows

Wait for the download to finish. Keep the publisher's checksum page open and locate the downloaded file in File Explorer. You do not need to launch the installer to check it.

1. Open Windows PowerShell

Open Start, type Windows PowerShell, and open the normal application. Windows includes it; this procedure does not need a separately installed hashing app. Microsoft's Windows PowerShell installation guidance documents the Windows 10 and 11 route.

Use a file you can already read, such as your completed download. An access error is a reason to check the file's location or permissions, rather than automatically reopening the terminal as an administrator.

2. Enter the file's full path

Use Read-Host to enter the path as text. Run this line:

$file = Read-Host 'Full path to the downloaded file, without quotes'

When prompted, enter the complete path, including the filename and extension. For example, if your Windows user folder is Alex and the EXE is in Downloads:

C:\Users\Alex\Downloads\vlc-3.0.20-win64.exe

Use your actual path. If you copied it with quotation marks around it, remove those surrounding marks when entering it at this prompt. Spaces inside the path are fine.

3. Calculate the checksum

Run:

Get-FileHash -LiteralPath $file -Algorithm SHA256 |
    Format-List Algorithm, Hash, Path

Check that the displayed path identifies your download.

In Get-FileHash , -LiteralPath treats filename characters such as square brackets literally; -Algorithm SHA256 selects the algorithm.

Compare the complete value

SHA-256 produces a 256-bit digest, represented here by 64 hexadecimal characters. That length follows from the NIST Secure Hash Standard : each hexadecimal character represents four bits.

Checking a few characters at the beginning and end leaves most of the value unchecked. Let PowerShell compare the complete strings instead.

In the same PowerShell window, run this line first:

$expected = (Read-Host 'Paste only the publisher SHA-256 value').Trim()

At the prompt, paste only the publisher's 64-character SHA-256 value and press Enter. Then run the comparison:

(Get-FileHash -LiteralPath $file -Algorithm SHA256 -ErrorAction Stop).Hash -eq $expected

PowerShell's equality comparison ignores letter case by default, so uppercase and lowercase hexadecimal letters compare equally.

• True: the calculated value matches the value you supplied.
• False: the values differ. Check the reference and file before using the download.
• An error: the check did not complete. Resolve the error and run it again.

The -ErrorAction Stop setting makes a file-reading failure stop that comparison instead of treating it as a completed hash check. If you close PowerShell, start again with the path prompt; the variables belong to that window.

If the checksum does not match

Leave the download unopened while you check the likely mix-ups.

First, revisit the exact file and release. In the VLC example, comparing the EXE with the ZIP's checksum is the wrong comparison even if both downloads completed correctly. Also check whether you selected a 32-bit, 64-bit or ARM package, where the publisher offers those choices.

Next, confirm that both sides use SHA-256. A value labelled SHA-1, SHA-512 or MD5 belongs to a different algorithm. Recheck what you pasted: a filename, missing character or line copied from a neighbouring entry can explain a failed comparison.

If the reference is correct, download a fresh copy through the publisher's official route and repeat the check. Canonical's download-verification tutorial similarly treats an unexplained mismatch as a reason to obtain a fresh copy from a known good source.

If it still differs, stop and ask the publisher through its support channel. Keep the exact filename, release, expected checksum and calculated checksum with your report. Do not edit the expected value to make the comparison pass.

Why a renamed file can still match

The checksum concerns file contents. Renaming the file can leave those contents untouched; editing its contents changes what gets hashed.

A small calculated example makes the distinction concrete. Each file below contains exactly three ASCII bytes, with no line break or other extra bytes:

The two abc files produce the same SHA-256. Changing the last byte to d produces a different value, even though all three files have the same size.

For a published ZIP checksum, hash the downloaded ZIP. Extracted files require their own references.

What a matching checksum leaves unanswered

The comparison depends on where the expected value came from. If someone supplies both an altered download and a matching checksum for it, the comparison can succeed. That is why the reference should come through the publisher's trusted release information.

Some projects also sign their checksum lists. Canonical's Ubuntu verification procedure separates authenticating the checksum list from comparing the downloaded ISO with it. If a publisher supplies a signed list, follow its verification instructions; calculating a file hash alone does not perform that signature check.

A matching value also says nothing about whether the software's intended behaviour is something you want on your PC. Keep normal security checks in place and take warnings seriously.

Sources

• Microsoft: Get-FileHash, Windows PowerShell 5.1 .
• Microsoft: Installing Windows PowerShell, documentation preserved at a December 2022 revision .
• Microsoft: PowerShell comparison operators .
• Microsoft: Read-Host, Windows PowerShell 5.1 .
• Microsoft: PowerShell common parameters, including ErrorAction .
• NIST: FIPS 180-4, Secure Hash Standard, August 2015 .
• VideoLAN: VLC 3.0.20 Windows 64-bit files and checksums, October 2023 .
• Canonical: How to verify your Ubuntu download .