What is checksum verification?
Checksum verification is how you prove a downloaded file is exactly what its publisher released — byte for byte. The publisher computes a cryptographic hash (a "checksum") of the original file and publishes it next to the download link. You compute the hash of the file you received and compare the two. If they match, the file is intact. If they don't, the download was corrupted — or worse, tampered with.
This matters most for: operating system ISOs (Ubuntu, Debian and others publish SHA256SUMS files for every release), firmware updates, and any software downloaded outside an app store.
How to verify a checksum on Windows
No install needed — Windows ships the tools:
certutil -hashfile C:\Downloads\ubuntu-24.04.iso SHA256
Or in PowerShell:
Get-FileHash C:\Downloads\ubuntu-24.04.iso -Algorithm SHA256
Compare the output with the hash on the download page. (Or skip the terminal entirely: drag the file into the tool above.)
How to verify a checksum on macOS
shasum -a 256 ~/Downloads/file.dmg
md5 ~/Downloads/file.dmg # for MD5
How to verify a checksum on Linux
sha256sum ubuntu-24.04.iso
sha256sum -c SHA256SUMS # verify a whole batch from a checksum file
The -c flag is the command-line equivalent of the batch section above.
Checksum file formats: GNU vs BSD
Checksum files come in two dialects, and this tool reads both:
- GNU style (from
md5sum / sha256sum):
ba7816bf…15ad ubuntu-24.04.iso — two spaces mean text mode; a space followed by * (hash *file) means binary mode. The marker doesn't change the hash.
- BSD style:
SHA256 (ubuntu-24.04.iso) = ba7816bf…15ad
Lines starting with #, blank lines, and malformed lines are skipped and reported — so you can paste real-world checksum files without cleaning them up first.
What to do if the checksum doesn't match
- Do not install, open, or run the file. A mismatch means it is corrupted or tampered with.
- Delete it and download again — preferably from a different mirror.
- If the second download also mismatches, the published hash itself may be stale; check the publisher's official channels (and their PGP/GPG signatures if offered).
MD5 vs SHA-256 — which should I use?
Use the strongest hash the source publishes — SHA-256 or better. MD5 is broken against deliberate collisions (an attacker can craft two files with the same MD5), though it's still fine for catching accidental corruption. Never "upgrade" a published MD5 to SHA-256 yourself; only the publisher's value counts.
What happened to Microsoft's File Checksum Integrity Verifier (FCIV)?
FCIV was Microsoft's free command-line checksum tool (MD5 and SHA-1 only). It was discontinued years ago and never updated for modern algorithms. If you landed here searching for "microsoft file checksum integrity verifier download" — this page is its modern replacement: six algorithms instead of two, drag-and-drop instead of a 2004-era CLI, batch verification, and no install.
How this compares
| This tool | emn178 md5_checksum | onlinemd5.com | Microsoft FCIV |
|---|
| Algorithms | 6 (MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256) | MD5 only | MD5 / SHA-1 | MD5 / SHA-1 |
| One-pass multi-hash | Yes | — | — | — |
| Large files (GB) | Chunked + progress | Basic | Basic | Yes (CLI) |
| Expected-hash verdict | Auto-detect + MATCH/MISMATCH | — | — | Manual compare |
| Batch .sha256sum verify | GNU + BSD formats | — | — | — |
| Files never uploaded | Yes | Yes | Not confirmed | Local CLI |
| Install required | None | None | None | Download (discontinued) |
Feature comparison as of October 2026, based on each tool's public pages. Competitors may have changed since — if you spot an error, the page source is one click away.