How to check that a download hasn't been tampered with (SHA-256)
You download an installer, an operating system image or a firmware update. How do you know it is exactly what the developer published — not a broken file, and not a copy someone modified?
The real risk
- Look-alike sites and ads: searching for popular free software often shows sponsored results that lead to repackaged installers with adware or malware.
- Hacked servers: in 2016 the website of a well-known Linux distribution was compromised and its download link pointed to an ISO with a backdoor for part of a day. Users who compared the checksum with the official one could spot it.
- Corrupted downloads: an interrupted transfer can break a firmware update and leave a device unusable.
What a checksum is
A checksum, or hash, is a fingerprint calculated from every byte of a file. Change a single byte and the fingerprint changes completely. Developers publish the SHA-256 value next to their downloads, often in a file called SHA256SUMS.
Check it in three steps
- Find the checksum on the developer's official site — not on the page that offered you the download.
- Drop the file into the download checker and paste the official value.
- Green means identical. Red means delete the file and download it again from the official source.
The file is read in small pieces inside your browser, so even multi-gigabyte images never leave your computer.
Which algorithm?
Use SHA-256 or SHA-512. MD5 and SHA-1 still catch accidental corruption, but researchers can create two different files with the same MD5 or SHA-1, so they don't prove a file wasn't deliberately altered.
What a checksum can't do
If the attacker controls the official site, they can change the checksum too. That's why some projects also sign their files cryptographically. For everyday downloads, though, checking the hash from the official page catches most problems.