What is a File Hash?

A file hash (also called a checksum) is a string of characters produced by running a file through a hash algorithm. The algorithm processes every byte in the file and produces a digest — typically displayed as a hexadecimal string.

Hash algorithms have a critical property: even a tiny change to the input produces a completely different output. If one byte in a 4GB operating system image changes, its SHA-256 hash will look nothing like the original. This sensitivity to change is what makes hashes useful for integrity checking.

Common algorithms used for file hashing:

  • MD5 — 32 hex characters, fast, but cryptographically broken (see our comparison guide)
  • SHA-1 — 40 hex characters, deprecated
  • SHA-256 — 64 hex characters, current recommended standard
  • SHA-512 — 128 hex characters, highest security

Why File Hash Verification Matters

Three scenarios make hash verification important:

1. Detecting Download Corruption

Network errors can corrupt files during download without producing any visible error message. Verifying the hash ensures the download was complete and uncorrupted. This is especially important for large files like OS images and software installers.

2. Verifying Authenticity

When a software publisher posts the SHA-256 hash of their installer alongside the download link, verifying the hash confirms you received exactly what they published. An attacker who substituted a malicious file (e.g., via a compromised CDN) would produce a different hash.

3. Auditing and Forensics

In IT and security auditing, hashing files before and after a system event creates a tamper-evident record. Digital forensics relies on hash verification to demonstrate that evidence has not been altered.

Important limitation: Hash verification only proves that the file matches the published hash. It does not prove that the published hash itself is legitimate. Always obtain the hash from the official publisher's website over HTTPS — not from the same download link.

Which Algorithm to Use

For new verification workflows, use SHA-256. It is widely supported, produces a 64-character digest, and has no known practical attacks. SHA-512 is also fine but produces a longer digest with no practical security advantage for file integrity.

Accept MD5 only if it is the only option provided by the publisher, and only for accidental corruption detection (not security). Never use MD5 where an attacker might be involved.

Generating Hashes on Windows

Windows includes hash generation natively via PowerShell — no additional software required.

SHA-256 (recommended):

Get-FileHash C:\Users\You\Downloads\installer.exe -Algorithm SHA256

MD5:

Get-FileHash C:\Users\You\Downloads\installer.exe -Algorithm MD5

SHA-512:

Get-FileHash C:\Users\You\Downloads\installer.exe -Algorithm SHA512

The output shows the algorithm, hash value, and file path. Copy the hash value for comparison.

Alternatively, the legacy Command Prompt tool certutil also works:

certutil -hashfile C:\path\to\file.exe SHA256

Generating Hashes on macOS

macOS includes hash utilities in Terminal:

SHA-256:

shasum -a 256 ~/Downloads/installer.dmg

MD5:

md5 ~/Downloads/installer.dmg

SHA-512:

shasum -a 512 ~/Downloads/installer.dmg

The shasum command is available on all modern macOS versions. The output format is hash filename.

Generating Hashes on Linux

Linux provides dedicated utilities for each algorithm:

SHA-256:

sha256sum ~/Downloads/ubuntu.iso

MD5:

md5sum ~/Downloads/ubuntu.iso

SHA-512:

sha512sum ~/Downloads/ubuntu.iso

Linux distributions often ship a .sha256 file alongside download images. You can verify against it automatically:

sha256sum -c ubuntu-24.04.sha256

This checks all hashes listed in the file and reports whether each file passed or failed.

Generating Hashes Online

If you are on a device without command-line access, or prefer a quick browser-based option, ToolMasta's hash generator computes file hashes entirely in your browser. The file is read using the browser's FileReader API and never sent to any server — making it safe for sensitive files.

Supported algorithms: MD5, SHA-1, SHA-256, SHA-512. Simply drop or select your file and the hash is computed and displayed instantly.

How to Compare Hashes

Once you have the hash of your downloaded file, compare it character-by-character to the hash published by the software author. Even one character difference means the files are different.

Tips for accurate comparison:

  • Case does not matter — a1b2c3 and A1B2C3 represent the same hash
  • Use a monospace font to make comparison easier
  • Copy-paste both hashes into a diff tool or text editor and use find-and-replace to spot differences quickly
  • Some tools (including ToolMasta's hash generator) allow you to paste the expected hash and show a visual match/mismatch indicator

Real-World Use Cases

  • OS installation media: Linux distributions, Windows ISOs, and macOS installers all publish SHA-256 checksums. Always verify before burning or flashing to USB.
  • Software downloads: Security tools, developer SDKs, and browser downloads increasingly publish SHA-256 hashes.
  • Email attachments: Share the SHA-256 hash of a file via a separate channel (e.g., Signal message) to verify the file arrived intact.
  • Backup integrity: Hash files before archiving and re-hash when restoring to confirm data integrity over time.
  • Legal and compliance: Hash evidence files before and after analysis to demonstrate they were not modified.

Try It Free — No Signup Required

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes for any file — instantly in your browser, with no uploads required.

Open Hash Generator