You have downloaded an installer, but something makes you hesitate. Perhaps it came from a mirror, the connection dropped halfway through, or you copied it between computers. The filename looks right. Is there a useful check you can do before opening it?
You can verify SHA256 checksum values when the publisher provides a reference hash for your download. This guide walks through the process on Windows, including what to do when the values disagree. You will not need to upload your installer to an unfamiliar website.
Quick answer: Calculate the downloaded file’s SHA256 hash in PowerShell, then compare it with the publisher’s SHA256 value for the exact same package. A match supports file integrity relative to that reference. It does not, by itself, establish that the software is safe.
Table of Contents
Why Verify SHA256 Checksum Before Installation?
A checksum is a value calculated from a file’s contents. SHA256 produces a hash commonly displayed as 64 hexadecimal characters. The useful comparison is between the value you calculate and a reference you have reason to trust.
Renaming a file does not change its content hash. Changing its contents does. Microsoft documents this behavior, along with the SHA256 default, in its Get-FileHash reference.
Think about the question you want answered before starting. “Did this USB copy preserve my original download?” requires comparing the original file with the copy. “Does this download match the publisher’s release?” requires the publisher’s reference value. These are different checks, even though the calculation is similar.
Verify SHA256 Checksum: 7 Easy Steps on Windows
1. Identify the exact package you downloaded
Write down the software name, release number, operating system, architecture, and package type. Do not treat every download on a release page as interchangeable.
For example, a Windows x64 installer and a Windows ARM64 installer serve different systems. A portable ZIP and an installed edition can also have separate download entries. If the architecture labels are confusing, read our explanation of 32-bit vs 64-bit software before choosing a package.
2. Find the publisher’s reference value
Look on the official release page for labels such as “SHA256,” “checksums,” or “verify download.” Some publishers provide a separate checksum file containing several filenames and their associated values.
Locate the entry for your precise package. Keep that page open while you work. A hash copied from an unrelated forum post is a weaker starting point because you have added another party to the trust chain.
Where a project supplies signed checksum files, follow its complete verification instructions. For an example of that more rigorous workflow, see Ubuntu’s official download verification guide, which separates checking the checksum file’s authenticity from checking the downloaded image.
3. Wait for the download to finish
Check that your browser reports completion. Avoid selecting a temporary download or a similarly named older copy. If several files share the same name with suffixes such as “(1)” and “(2),” move the one you intend to inspect into a clearly named folder.
For this walkthrough, imagine that your downloaded file is called ExampleApp-Setup.exe. This is a placeholder, not a product recommendation or a real file you need to obtain.
Before you verify SHA256 checksum values, make sure you have selected the completed download rather than an older copy.
4. Calculate the hash in PowerShell
Open PowerShell from Windows search. Replace the example path below with the actual location of your downloaded file, keeping the quotation marks:
Get-FileHash -LiteralPath 'C:\Users\YourName\Downloads\ExampleApp-Setup.exe' -Algorithm SHA256The command reads the file to calculate its hash; it does not launch the installer. The output includes the algorithm, hash, and file path. These command parameters and output fields are described in the Microsoft documentation.
5. Compare the full value
Compare the calculated hash with the reference for your package. Check the entire value, not just its beginning and end. Uppercase and lowercase hexadecimal letters represent the same value.
You can also perform the comparison in PowerShell. Replace the placeholder text with the publisher’s full hash before running these lines:
$expected = 'PASTE_THE_PUBLISHERS_SHA256_VALUE_HERE'
$actual = (Get-FileHash -LiteralPath 'C:\Users\YourName\Downloads\ExampleApp-Setup.exe' -Algorithm SHA256).Hash
$actual -eq $expected.Trim()True means the compared values match. False means they do not. Leaving the placeholder unchanged will not produce a meaningful verification.
6. Investigate a mismatch before installation
First check your selection: version, architecture, installer type, and algorithm. Comparing the wrong two entries is easy when a release offers several downloads.
If those details agree, download the file again from the official source and repeat the check. Keep the new copy separate so you do not accidentally calculate the older file’s hash. If the mismatch persists, ask the publisher to confirm the release value before proceeding.
A mismatch gives you a reason to pause. It does not identify the cause by itself, so avoid immediately assuming either a harmless download problem or a confirmed attack.
7. Continue with your normal installation checks
After a match, return to the broader installation decision. Is this the software you intended to install? Is the publisher the one you expected? Does the application support your system? Did your security software raise a warning?
Use our guide to downloading software safely for the surrounding checks. Hash verification is most useful when it adds evidence to a sensible download process.
A Practical Example: Same App, Different Downloads
Imagine a fictional publisher offering the following packages for version 4.2. You downloaded the portable edition but copied the checksum beside the standard installer. The values disagree even though you may have downloaded exactly what the publisher intended.
| Package | Reference to select | Common mistake |
|---|---|---|
| Windows x64 installer | The x64 installer entry for version 4.2 | Using the ARM64 entry |
| Windows portable ZIP | The ZIP entry for version 4.2 | Using the EXE entry |
| Previous release | The reference for that older release | Using the latest release’s checksum |
This is why package selection comes before troubleshooting the connection. Keep a short note alongside archived installers: download source, release, package name, and reference checksum. It makes a later comparison easier to understand.
Verify SHA256 Checksum: Common Problems
PowerShell cannot find the file
Check the path and extension. A file saved on the Desktop will not be found by a command pointing to Downloads. Copy the actual file path rather than rebuilding it from memory, and check that your command still contains the quotation marks.
The result is hard to copy
Display only the hash with this variation:
(Get-FileHash -LiteralPath 'C:\Users\YourName\Downloads\ExampleApp-Setup.exe' -Algorithm SHA256).HashCopy the value without extra labels. When working from a checksum list, avoid accidentally including the filename alongside the hash.
The publisher has no checksum
You can calculate a hash, but you cannot claim a publisher-reference match without a reference. Do not invent one or substitute the value of a different release. Obtain the file through the publisher’s intended distribution channel and use the other verification methods it provides.
What Verification Cannot Prove
A matching hash does not review an application’s behavior, permissions, privacy practices, or licensing. It cannot tell you whether the program is a good choice for your work. Those questions require separate evidence.
The reference source matters too. If an attacker could replace both a download and its unsigned reference checksum, comparing the two would not expose that substitution. Ubuntu’s verification guide illustrates why authenticating signed checksum information can be a separate step.
Likewise, a perfectly matching download can still be incompatible with your computer. Before running it, review our software compatibility checklist.
Frequently Asked Questions
Do I need to upload the file to verify it?
No. The PowerShell method shown here calculates the hash locally. You still need a trustworthy reference value for the comparison.
Should I compare an extracted file with the ZIP checksum?
No. If the reference belongs to the ZIP download, calculate the hash of that ZIP. The extracted installer is a different file.
Does a match mean I should ignore an antivirus warning?
No. Investigate the warning separately. A reference match and a security assessment answer different questions.
Can I check a file copied to a USB drive?
Yes. Calculate the hash of the source file and the copy, then compare them. This checks the copy against your source, not against an independent publisher reference.
Verify SHA256 Checksum Before Your Next Install
To verify SHA256 checksum values effectively, start with the right package and a trustworthy reference. Calculate the downloaded file’s hash, compare it carefully, and resolve any mismatch before installation. Keep the result in context: it is useful evidence about file integrity, alongside the other checks that help you choose and install software responsibly.