How to Verify a File Hash with sha256sum

By Ravindra Bagale, Cyber Security trainer LinkedIn Published: 27 October 2026 Last updated: 27 October 2026

A hash is a short fingerprint of a file. After you download software, run sha256sum file and compare it to the hash the vendor published. If they differ, do not run the file. On Windows you can use Get-FileHash in PowerShell.

Quick answer

sha256sum installer.iso
echo "PUBLISHED_HASH  installer.iso" | sha256sum -c -

Why verify hashes?

Mirrors get poisoned. Downloads get cut off mid-way. A hash mismatch saves you from running stranger code. Jin in Seoul and Farhan in Lucknow both check ISOs before class labs.

What is a SHA-256 hash?

A 64-hex-character fingerprint. Change one byte of the file and the hash changes completely. It does not encrypt the file.

Google searches like "what is hashing in cyber security" often want this idea. Your course lesson 33.1 goes deeper; this guide is the hands-on check.

How do I verify step by step?

Download tool.tgz from the vendor.
Hash it:
```
sha256sum tool.tgz
```
```
3b8a9c0d1e2f45566778899aabbccddeeff00112233445566778899aabbccdd  tool.tgz
```
What it means: Your fingerprint. Match it character-for-character with the vendor line.
Compare to the published value (must match exactly).
Or use a checksum file:
```
sha256sum -c SHA256SUMS
```
```
tool.tgz: OK
```
What it means: OK means the file matches the listed hash.
On Windows PowerShell:
```
Get-FileHash .\tool.tgz -Algorithm SHA256
```
What it means: PowerShell prints the Hash field for the same check.

Ravindra Bagale's Tip

Get the published hash from HTTPS on the vendor site, not from a random forum mirror. Hashing answers "same bits?" — not "is this software kind". Still prefer signed releases when you can.

Quick quiz: check what you learned

If two files have the same SHA-256, they are:
1. Almost certainly the same bytes
2. Guaranteed free of all malware
3. Encrypted with a secret key
4. Empty with zero file length
Show answer
A. Same hash means same content (for practical purposes).
Password storage should use:
1. A salt and a slow KDF such as bcrypt
2. Publishing the password in git
3. MD5 only with no salt at all
4. Storing hashes in HTML page titles
Show answer
A. Fast hashes alone are wrong for passwords.

Learn it properly

This guide is the short path. These pages go deeper, with labs:

Frequently asked questions

What is sha256sum used for?

To fingerprint a file and detect changes or corrupt downloads.

What if the hash does not match?

Do not execute the file. Re-download from a trusted source or investigate tampering.

Is MD5 OK?

Prefer SHA-256. MD5 is too weak for security checks.

Windows equivalent?

Get-FileHash .\file -Algorithm SHA256 in PowerShell.

Related Cyber lesson?

33.1 Encoding, hashing and goals; 33.2 Hashing and password storage.