How to Verify File Integrity with SHA-256 Checksums
Verifying a file's integrity means hashing the downloaded file locally with SHA-256 and comparing the resulting 64-character hexadecimal digest against the publisher's official published checksum. If even a single bit was tampered with by malware or corrupted by network packet loss, the hashes will fail to match, warning you before you execute the software.
Never run critical downloaded binaries without verification. Publishers post official SHA-256 checksums alongside their software. Running a quick terminal command (shasum -a 256 filename on macOS/Linux or Get-FileHash on Windows) proves whether the binary in your downloads folder is byte-for-byte identical to the original release.
01. The Plain-Language Analogy: The Holographic Tamper Seal
Imagine receiving a high-security shipping crate containing critical aircraft parts. Rather than dismantling all 5,000 internal precision gears to ensure no one tampered with the crate in transit, the factory placed a serialized, holographic tamper-evident tape across all box seams.
The factory publishes that exact serial code on their corporate security board. When the crate arrives at your hangar, you verify that the holographic tape is intact and matches the serial number. If an eavesdropper cut the tape or substituted a counterfeit part, the seal fractures visibly. A SHA-256 checksum is an unforgeable digital holographic seal: altering even one byte out of ten billion bits irreversibly fractures the hash into an entirely different 64-character string.
02. Step-by-Step Mechanics: Verifying in the Terminal
Run the built-in SHA-256 command against your downloaded file:
In PowerShell, execute the native cryptographic utility:
When downloading a manifest file with multiple files, verify automatically:
Returns OK for matching files, or FAILED if any bit differs.
import crypto from 'node:crypto';
import fs from 'node:fs';
// Stream-based SHA-256 verification (memory-efficient for multi-gigabyte ISO files)
function verifyFileSHA256(filePath: string, expectedHash: string): Promise<boolean> {
return new Promise((resolve, reject) => {
const hash = crypto.createHash('sha256');
const stream = fs.createReadStream(filePath);
stream.on('data', chunk => hash.update(chunk));
stream.on('error', err => reject(err));
stream.on('end', () => {
const calculatedHash = hash.digest('hex');
console.log('Calculated SHA-256:', calculatedHash);
console.log('Expected SHA-256: ', expectedHash);
resolve(calculatedHash.toLowerCase() === expectedHash.toLowerCase());
});
});
}03. Worked Example: Ubuntu 24.04 LTS Desktop ISO (Live Data)
This is the authentic published release hash from Canonical for the official Ubuntu 24.04 Noble Numbat LTS desktop installation media:
81fae9cc21e2b1b3a80de60cb62d8845b48c58908f5d5b5624c57c4f0273e181 If an attacker intercepted your download and inserted a keylogger into the kernel, the resulting hash would change entirely. Checking this hash takes 4 seconds and protects your entire machine.
04. Common Misconceptions Corrected
Reality: HTTPS only guarantees that the file was encrypted between your computer and the download server. If the server itself, a regional download mirror, or a third-party CDN is breached (as occurred during the Linux Mint incident in 2016), HTTPS cheerfully delivers a backdoored ISO with a valid green padlock.
Reality: Skimming only the beginning or end of a hash leaves you vulnerable to chosen-prefix attacks or lazy visual spoofing. Always compare the full 64 characters or let the shell compare them automatically (echo "$EXPECTED $FILE" | sha256sum -c).
Reality: CRC32 is not a cryptographic hash; it is an error-detecting code designed solely for accidental line noise. MD5 was mathematically broken for collisions in 2004. Attackers can easily craft a malicious executable that produces the identical MD5 or CRC32 checksum as a clean binary. Only SHA-256 or SHA-512 are cryptographically secure against intentional modification.
05. Defense-in-Depth: Combining PGP Signatures with SHA-256
What if an attacker hacks the main website and changes both the download link and the published SHA-256 hash? Defense-in-depth requires signed checksum files:
gpg --verify SHA256SUMS.gpg SHA256SUMS Proves cryptographically that the list of checksums was created by the publisher's offline master PGP key.
sha256sum -c SHA256SUMS Proves that the multi-gigabyte ISO you downloaded matches the signed checksum byte-for-byte.