Verify a download with SHA-256
How to verify a download with SHA-256
Compare your download with a SHA-256 from a trusted source. This checks file integrity; it does not establish publisher identity or guarantee that the file is safe.
Find the hash the publisher gives
Find the 64-character SHA-256 on the publisher's official download page or release notes. Make sure it is for the exact version and file you downloaded. The check depends on trusting that source; without an expected hash, you cannot compare them.
Open Command Prompt where the file is
In File Explorer, open the folder holding the download, click the address bar, type cmd and press Enter. Command Prompt opens already pointed at that folder.
Run certutil
Type: certutil -hashfile "FILENAME" SHA256 - replacing FILENAME with the actual name of the file and keeping the quotes, especially if the name contains spaces. certutil is part of Windows and prints the file's SHA-256 hash.
Compare the two strings
Compare all 64 hexadecimal characters. Letter case and spaces do not matter, but every hexadecimal character must match. Do not check only the beginning and end. The PowerShell comparison below can check the complete strings for you.
Do not run it if they differ
A mismatch means the file does not match the expected hash. Check that you used the hash for the right version, then download again from the publisher's official site and recheck. If it still differs, stop and contact the publisher. Do not run it.
What this actually proves
SHA-256 creates a 64-character hexadecimal fingerprint of a file's contents. Matching the complete hash is a practical check that the download has the same contents as the file used to produce the expected hash. Use the hash for that exact release and file.
The expected hash must come from a source you trust. If someone replaces both the download and its published hash, the two will still match. A hash comparison does not authenticate the publisher or inspect the program for malicious behaviour.
Hash versus code signature
A valid Authenticode signature ties signed software to a publisher through a trusted certificate chain and checks the integrity of the signed content. Windows can use that signature to identify the publisher. An unsigned download lacks that check.
A published SHA-256 lets you compare the whole downloaded file with an expected value. It complements a signature rather than replacing it. Neither a valid signature nor a matching hash guarantees that a program is safe to run.
Trying it on EasyUnZip
SHA-256 of the EasyUnZip 0.1.2 installer:
8b37b1190c0b00bb0afe380c6164130a00d8250c876dac47bba207f33254f3dd
certutil -hashfile "EasyUnZip-Setup.exe" SHA256
The current installer is not code-signed.The security page explains the download checks and their limits. Use the hash printed for the file you downloaded, rather than one saved from an earlier release. If you renamed the file or your browser added a suffix, use its actual name.
PowerShell, if you prefer it
Get-FileHash -LiteralPath ".\EasyUnZip-Setup.exe" -Algorithm SHA256
PowerShell computes the same SHA-256. To compare the complete hash against the current EasyUnZip release, run:
(Get-FileHash -LiteralPath ".\EasyUnZip-Setup.exe" -Algorithm SHA256).Hash -eq "8b37b1190c0b00bb0afe380c6164130a00d8250c876dac47bba207f33254f3dd"
True means all 64 hexadecimal characters match, ignoring letter case.False means they differ. An error is not a successful check. Even a match does not make a security warning safe to ignore.
Guidance checked on 7 October 2026 against Microsoft'sGet-FileHash documentation,Authenticode documentationand SmartScreen overview.
Common questions
How do I check a SHA-256 hash in PowerShell instead?
Get-FileHash -LiteralPath ".\FILENAME" -Algorithm SHA256 computes the same hash. Replace FILENAME with the actual name. SHA256 is the default algorithm; -LiteralPath keeps brackets and other filename characters from acting as wildcards.
What is the difference between SHA-256 and a code signature?
A matching SHA-256 checks that your download matches the published file, provided you trust the source of the hash. A valid Authenticode signature also verifies the signing publisher and the integrity of signed content. A checksum does not replace a signature, and neither check guarantees software is safe.
Does a matching hash mean the file is safe?
No. It checks that the file matches the hash you compared it with. A malicious file can have a matching hash too, and a compromised site could replace both the download and its hash. Use a trusted source, keep security protections enabled, and take any warning seriously.
Why does Windows warn about the installer even when the hash matches?
SmartScreen checks downloaded programs for known threats and reputation. It may warn about a new or unfamiliar file even when its hash matches, but the hash does not establish why the warning appeared or make it safe to ignore. If Windows blocks the file or you are unsure, stop and contact the publisher.
certutil says the file cannot be found. What now?
Command Prompt is not in the folder holding the file, or the name is not what you typed. Explorer hides known extensions by default, so a file shown as Setup is really Setup.exe. Drag the file onto the Command Prompt window and it types the full path for you.
Is MD5 good enough for this?
Use SHA-256 for security checks. Microsoft no longer considers MD5 or SHA-1 secure against attacks and advises against using them for files that need protection from tampering. They can still detect ordinary accidental changes.