MD5 vs SHA-256: Verifying Downloads with Checksums
What checksums are, the difference between MD5, SHA-1 and SHA-256, and how to check a file's hash on Windows, Mac, Linux or in your browser.
Software sites often list a long string like 3f79bb7b435b05321651daefd374cdc681dc06faa65e374e38337b88ca046dea next to a download. That's a checksum (or hash), a fingerprint of the file. If the file you downloaded produces the same fingerprint, it's exactly the file the publisher released.
What a hash protects against
- Corruption: a broken download or a bad USB stick.
- Tampering: a mirror or attacker serving a modified file, as long as you got the hash from the official site.
MD5, SHA-1, SHA-256: which one?
| Algorithm | Length | Status |
|---|---|---|
| MD5 | 32 hex characters | Broken for security; still fine for spotting corruption |
| SHA-1 | 40 hex characters | Broken for security since 2017 |
| SHA-256 | 64 hex characters | Current standard: use this |
| SHA-512 | 128 hex characters | Also secure |
"Broken" means someone can deliberately craft two different files with the same MD5 or SHA-1. It doesn't happen by accident, so MD5 still catches a corrupted download.
Check a hash in your browser
- Open the checksum calculator and choose the file.
- Paste the published hash into the box. It turns green on a match.
The file is hashed locally, so even multi-gigabyte ISOs never get uploaded.
Check a hash from the command line
- Windows (PowerShell):
Get-FileHash file.iso -Algorithm SHA256 - Mac:
shasum -a 256 file.iso - Linux:
sha256sum file.iso