How to Verify a SHA-256 Checksum on Windows, macOS, and Linux

如何在 Windows、macOS 和 Linux 上验证 SHA-256 校验和

You download an ISO, installer, archive, or release binary. The publisher provides a long value such as: 9f86d081884c7d659a2feaa0c55ad015 a3bf4f1b2b0b822cd15d6c15b0f00a08 That value is a checksum, usually generated with SHA-256. Verifying it answers one practical question: Does the file you downloaded have exactly the same contents as the file the publisher hashed? A checksum mismatch can indicate a damaged download, an incomplete transfer, the wrong file version, or modified contents.

当你下载 ISO 镜像、安装程序、压缩包或二进制发行版时，发布者通常会提供一串长字符，例如：9f86d081884c7d659a2feaa0c55ad015 a3bf4f1b2b0b822cd15d6c15b0f00a08。这个值就是校验和（Checksum），通常使用 SHA-256 算法生成。验证它的目的是回答一个实际问题：你下载的文件内容是否与发布者进行哈希处理的文件完全一致？校验和不匹配可能意味着下载损坏、传输不完整、文件版本错误或内容已被篡改。

Before verifying anything

在验证之前

Get the expected checksum from a source you trust. Ideally, use the software publisher’s official website, release page, package repository, or signed checksum file. A matching checksum confirms that your file matches the data represented by the expected hash. It does not prove that the original publisher or website was trustworthy. If an attacker can replace both the download and the displayed checksum, they can make the two values match. For stronger authenticity verification, use a signed release when the publisher provides one.

请从你信任的来源获取预期的校验和。理想情况下，请使用软件发布者的官方网站、发布页面、软件包仓库或已签名的校验和文件。校验和匹配仅确认你的文件与预期哈希值所代表的数据一致，但这并不能证明原始发布者或网站是可信的。如果攻击者能够同时替换下载文件和显示的校验和，他们就能使两者匹配。为了获得更强的真实性验证，如果发布者提供了已签名的版本，请优先使用。

Verify SHA-256 on Windows

在 Windows 上验证 SHA-256

Open PowerShell in the folder containing the downloaded file. Run: Get-FileHash ".\filename.iso" -Algorithm SHA256 Example: Get-FileHash ".\ubuntu.iso" -Algorithm SHA256

在包含下载文件的文件夹中打开 PowerShell，运行： Get-FileHash ".\filename.iso" -Algorithm SHA256 示例： Get-FileHash ".\ubuntu.iso" -Algorithm SHA256

PowerShell returns something similar to: Algorithm : SHA256 Hash : 4A1F... Path : C:\Users\You\Downloads\ubuntu.iso Compare the value beside Hash with the checksum published by the download provider. Uppercase and lowercase letters do not matter in hexadecimal hashes. The characters themselves must otherwise match exactly.

PowerShell 将返回类似以下内容： Algorithm : SHA256 Hash : 4A1F... Path : C:\Users\You\Downloads\ubuntu.iso 将“Hash”旁边的值与下载提供商发布的校验和进行比较。十六进制哈希值不区分大小写，但字符本身必须完全匹配。

Compare automatically in PowerShell Instead of comparing two 64-character values manually, store the expected checksum and let PowerShell compare them:

$expected = "PASTE_EXPECTED_SHA256_HERE"
$actual = (Get-FileHash ".\filename.iso" -Algorithm SHA256).Hash
if ($actual -eq $expected) { Write-Host "Checksum matches" } else { Write-Host "Checksum does not match" }

在 PowerShell 中自动比较 与其手动比较两个 64 位的字符值，不如将预期的校验和存储起来，让 PowerShell 自动比较：

$expected = "在此粘贴预期的 SHA256 值"
$actual = (Get-FileHash ".\filename.iso" -Algorithm SHA256).Hash
if ($actual -eq $expected) { Write-Host "校验和匹配" } else { Write-Host "校验和不匹配" }

Verify SHA-256 on macOS

在 macOS 上验证 SHA-256

Open Terminal and run: shasum -a 256 filename.dmg Example: shasum -a 256 application.dmg The result contains the calculated checksum followed by the filename: 4a1f... application.dmg Compare the calculated value with the publisher’s expected SHA-256 checksum. Quotes are useful when a filename contains spaces: shasum -a 256 "Application Installer.dmg"

打开终端并运行： shasum -a 256 filename.dmg 示例： shasum -a 256 application.dmg 结果包含计算出的校验和以及文件名： 4a1f... application.dmg 将计算出的值与发布者预期的 SHA-256 校验和进行比较。如果文件名包含空格，可以使用引号： shasum -a 256 "Application Installer.dmg"

Verify SHA-256 on Linux

在 Linux 上验证 SHA-256

Most Linux distributions provide sha256sum through GNU core utilities. Run: sha256sum filename.iso Example: sha256sum linux-distribution.iso The output looks like this: 4a1f... linux-distribution.iso Compare the first value with the checksum from the publisher.

大多数 Linux 发行版通过 GNU 核心工具提供 sha256sum。运行： sha256sum filename.iso 示例： sha256sum linux-distribution.iso 输出如下： 4a1f... linux-distribution.iso 将第一个值与发布者提供的校验和进行比较。

Verify a SHA256SUMS file on Linux Some projects provide a file named SHA256SUMS, checksums.txt, or something similar. A GNU checksum line normally looks like: 4a1f... linux-distribution.iso When the checksum file and downloaded file are in the same directory, run: sha256sum --check SHA256SUMS The short form also works: sha256sum -c SHA256SUMS A successful result looks like: linux-distribution.iso: OK A failure may look like: linux-distribution.iso: FAILED This method is safer than visually comparing long values because the command performs the comparison directly.

在 Linux 上验证 SHA256SUMS 文件 一些项目会提供名为 SHA256SUMS、checksums.txt 或类似的文件。GNU 校验和行通常如下所示： 4a1f... linux-distribution.iso 当校验和文件和下载的文件在同一目录下时，运行： sha256sum --check SHA256SUMS 简写形式同样有效： sha256sum -c SHA256SUMS 成功的结果如下： linux-distribution.iso: OK 失败的结果可能如下： linux-distribution.iso: FAILED 这种方法比肉眼比较长字符串更安全，因为命令会直接执行比较。

Verify a checksum without using the command line

不使用命令行验证校验和

For occasional checks, I built the Olivez Hash Generator & Checksum Checker. It supports SHA-256, SHA-384, and SHA-512 for files and exact text. The verification field accepts several common formats: 4a1f... 4a1f... filename.iso SHA256 (filename.iso) = 4a1f... SHA-256: 4a1f... It can also read multiline checksum lists and select the entry matching the chosen filename. Files and text are processed locally and are not uploaded. The current file limit is 100 MB, so command-line tools remain the better option for large ISO images and multi-gigabyte archives.

对于偶尔的检查，我制作了 Olivez 哈希生成器和校验和检查器。它支持文件和文本的 SHA-256、SHA-384 和 SHA-512 验证。验证字段接受几种常见格式： 4a1f... 4a1f... filename.iso SHA256 (filename.iso) = 4a1f... SHA-256: 4a1f... 它还可以读取多行校验和列表，并选择与所选文件名匹配的条目。文件和文本在本地处理，不会上传。目前文件限制为 100 MB，因此对于大型 ISO 镜像和数 GB 的压缩包，命令行工具仍然是更好的选择。

Why did my checksum fail?

为什么我的校验和验证失败了？

A mismatch does not automatically mean malware. Common causes include:

You downloaded a different version: Checksums change whenever file contents change. Version 2.1 and version 2.1.1 will normally have completely different hashes.
The download was incomplete or corrupted: Delete the file, download it again, and recalculate the checksum.
You selected the wrong algorithm: A SHA-256 value contains 64 hexadecimal characters. Calculating SHA-512 will never match a published SHA-256 value, even when both were generated from the same file.
The checksum belongs to another filename: Checksum lists often contain values for several operating systems, architectures, or package formats. Confirm that you are comparing the entry for the exact file you downloaded.
The expected value contains extra text: Make sure you are comparing the digest itself rather than copying punctuation, a filename, or the algorithm label into a field that expects only hexadecimal characters.

校验和不匹配并不一定意味着存在恶意软件。常见原因包括：

你下载了不同的版本： 只要文件内容发生变化，校验和就会改变。版本 2.1 和 2.1.1 通常会有完全不同的哈希值。
下载不完整或损坏： 删除文件，重新下载，然后重新计算校验和。
选择了错误的算法： SHA-256 值包含 64 个十六进制字符。计算 SHA-512 永远无法匹配发布的 SHA-256 值，即使两者都是从同一个文件生成的。
校验和属于另一个文件名： 校验和列表通常包含针对不同操作系统、架构或包格式的值。请确认你比较的是你下载的那个文件的条目。
预期值包含额外文本： 确保你比较的是摘要本身，而不是将标点符号、文件名或算法标签复制到仅需要十六进制字符的字段中。

SHA-256 is not password hashing

SHA-256 不是密码哈希

SHA-256 is useful for file integrity, release verification, content identification, and similar tasks. Do not store passwords as plain SHA-256 hashes. Password storage requires a dedicated password-hashing function such as Argon2id, scrypt, bcrypt, or PBKDF2 with appropriate parameters and unique salts.

SHA-256 适用于文件完整性、发布验证、内容识别等任务。请勿将密码存储为普通的 SHA-256 哈希值。密码存储需要专门的密码哈希函数，例如 Argon2id、scrypt、bcrypt 或 PBKDF2，并配合适当的参数和唯一的盐值（Salt）。

The practical rule

实用准则

Use the operating system command when you regularly verify files or work with large downloads:

Windows: Get-FileHash
macOS: shasum -a 256
Linux: sha256sum

Use a local-processing interface when you need to check a smaller file, compare text, parse a complete checksum line, or inspect a multiline checksum list without manually extracting the correct digest. Whichever method you use, obtain the expected checksum from a trusted source and make sure the algorithm, filename, and file version all match.

当你经常验证文件或处理大型下载时，请使用操作系统自带的命令：

Windows: Get-FileHash
macOS: shasum -a 256
Linux: sha256sum

当你需要检查较小的文件、比较文本、解析完整的校验和行，或在不手动提取正确摘要的情况下检查多行校验和列表时，请使用本地处理界面。无论使用哪种方法，请务必从可信来源获取预期的校验和，并确保算法、文件名和文件版本完全匹配。