Home › Official downloads › Guides
Check that a download is genuine
Compare the SHA-256 checksum of a file with the one published by the developer.
A checksum is a short fingerprint of a file. If even one byte changes, the fingerprint changes too. When the value you calculate matches the one the developer publishes, you have the exact file they released.
1. Find the official checksum
- Linux distributions publish
SHA256SUMSfiles next to each ISO on their download page. - Many open-source projects list SHA-256 values on their GitHub release page.
- Microsoft lists the SHA-256 of Windows ISOs on the Windows 11 download page after you choose a language.
2. Calculate the checksum of your file
Windows - open PowerShell in the download folder and run:
Get-FileHash .\file-name.iso -Algorithm SHA256Or install 7-Zip, right-click the file and choose 7-Zip › CRC SHA › SHA-256.
macOS - in Terminal:
shasum -a 256 ~/Downloads/file-name.dmgLinux - in a terminal:
sha256sum ~/Downloads/file-name.iso3. Compare
The two values must be identical (upper or lower case does not matter). If they differ, delete the file and download it again from the official site.