# How I check a file hash before trusting a download

A beginner-friendly guide to file hashes, checksums, SHA-256, and verifying that a downloaded file matches the publisher's digest.

- Date: 2026-09-27
- URL: https://ilham.dev/posts/how-to-check-a-file-hash-before-trusting-a-download/
- Markdown: https://ilham.dev/posts/how-to-check-a-file-hash-before-trusting-a-download/index.md
- Tags: hash, security, downloads, tools
- Reading time: 3 min


When I download an installer, ISO image, backup, or release archive, I sometimes see
a checksum published next to it:

```text
SHA256: 4a1f...
```

That checksum is there so I can check whether my downloaded file is exactly the same
file the publisher intended to provide.

The [File Hash Checker](/tools/file-hash-checker/) makes that check in the browser.

## The simple idea

A hash is a fingerprint of a file.

If the file changes, the hash changes. Even a tiny change should produce a different
hash.

That makes hashes useful for checking:

- corrupted downloads;
- incomplete files;
- accidental changes;
- whether a file matches a published release checksum.

## Step 1: download the file

Download the file normally. Do not rename or edit it before checking. Renaming does
not change the hash, but editing or unpacking does.

For example:

```text
ubuntu.iso
```

## Step 2: find the official checksum

Look for the checksum from the official source, not from a random comment or mirror.

A project may publish something like:

```text
ubuntu.iso  SHA256  abc123...
```

Prefer SHA-256 or SHA-512 when available. MD5 and SHA-1 still appear sometimes, but
they are old and not recommended for security decisions.

## Step 3: open the file hash checker

Open [File Hash Checker](/tools/file-hash-checker/) and choose the downloaded file.

The tool computes hashes locally. For large files, it may take a moment.

You may see several outputs:

- MD5;
- SHA-1;
- SHA-256;
- SHA-512.

## Step 4: compare the right hash

If the website gives a SHA-256 checksum, compare it with the SHA-256 result.

Do not compare a SHA-256 value with an MD5 value. They are different algorithms and
will not match.

I usually compare:

- first few characters;
- middle section;
- last few characters.

For important files, compare the whole string.

## Step 5: understand what a match means

If the hash matches, it means the file you have matches the file represented by that
checksum.

That is useful, but it depends on trusting the checksum source. If an attacker can
change both the file and the checksum on the same website, a hash alone does not save
you.

For higher assurance, some projects also provide signed checksum files. That is a
stronger verification flow.

## Step 6: understand what a mismatch means

If the hash does not match, do not run the file.

Common causes:

- download was incomplete;
- wrong file version;
- wrong algorithm compared;
- file was modified;
- checksum copied incorrectly;
- mirror has a bad or different file.

Download again from the official source and recheck.

## My file hash checklist

Before trusting an important download, I check:

1. Did I get the checksum from the official source?
2. Am I comparing the same algorithm, such as SHA-256 to SHA-256?
3. Did the computed hash match exactly?
4. If it failed, did I retry the download?
5. For very sensitive files, is there also a signature to verify?

A checksum is a simple safety step. It does not take long, and it can catch the kind
of mistake I do not want to discover after running the file.