Skip to main content
Skip to main content
SecurityJuly 25, 2026• 9 min read

Verify Downloaded ISO Checksums: Linux, Windows, and macOS

A corrupted ISO can fail hours into an install. Verify the SHA-256 checksum before you burn or write it, and never upload the file to do it.

Verify any file with the SHA-256 Hash Generator. Select the file, compare the hash locally, and nothing leaves your browser.

Why verify an ISO at all?

A multi-gigabyte download can be corrupted by a flaky connection, a broken mirror, or a misconfigured CDN. One flipped bit in the installer can cause crashes, failed upgrades, or subtle runtime bugs that are nearly impossible to trace back to the download.

The more important case is supply-chain tampering. An attacker who controls a mirror, an in-between proxy, or a compromised download link can swap the ISO for a modified one. If you install from that image, you are trusting the attacker's code with everything the machine will ever do.

A SHA-256 checksum is the standard defense: the publisher computes a fingerprint of the original image, you compute the fingerprint of the file you actually downloaded, and the two must match exactly.

Where to find the expected checksum

  • The official download page - most distributions list SHA-256 hashes next to each image
  • A dedicated checksums file - commonly named SHA256SUMS or sha256sums.txt in the same directory as the ISO
  • The distribution's documentation or release notes for the exact version you downloaded
  • A signed checksums file - advanced distributions also ship SHA256SUMS.asc or SHA256SUMS.sig for signature verification

Warning: Only trust checksums published over HTTPS on the official site, or the official signed checksums file. A hash copied from a forum or a random blog proves nothing - an attacker can publish a matching hash for a modified file.

Verify with a browser tool (no upload)

  1. Open the SHA-256 Hash Generator in your browser.
  2. Drag the downloaded ISO onto the file area, or use the file picker.
  3. Wait for the hash to be computed locally - a large ISO takes a few seconds to a minute depending on your machine.
  4. Compare the generated hash with the official checksum, character by character, or use the built-in compare field if available.
  5. If they match exactly, the image is intact. If they differ, delete the file and download again.

Note: Everything happens in your browser. The ISO never touches a server, which matters: uploading a 4 GB installer to a checksum website is itself a privacy and integrity risk.

Verify from the command line

Linux

# Generate the hash of the downloaded image
sha256sum ubuntu-24.04-desktop-amd64.iso
# Compare against the official list in one step
sha256sum -c SHA256SUMS
# Or compare two values directly
sha256sum ubuntu-24.04-desktop-amd64.iso
# 8c6f...  ubuntu-24.04-desktop-amd64.iso

macOS

shasum -a 256 ubuntu-24.04-desktop-amd64.iso
# macOS 13+ also ships the sha256sum alias
sha256sum ubuntu-24.04-desktop-amd64.iso

Windows (PowerShell)

Get-FileHash .\ubuntu-24.04-desktop-amd64.iso -Algorithm SHA256
# Classic alternative
certutil -hashfile ubuntu-24.04-desktop-amd64.iso SHA256

When checksums themselves are signed

A checksum only helps if you trust where it came from. An attacker who replaces the ISO on a mirror could also replace the SHA256SUMS file next to it.

Major distributions therefore sign the checksums file with GPG. You import the distribution's signing key over HTTPS, verify the signature of SHA256SUMS, and only then trust the hashes inside it.

The browser flow on this site covers the same integrity property for the file itself, but signature verification of the publisher's checksums is the stronger, end-to-end defense against a compromised mirror.

What a mismatch means

  • The download was truncated or corrupted in transit
  • The mirror served a different or older build
  • The file was modified after publication, possibly by an attacker
  • You hashed a different file than the one the checksum was made for - check filenames and versions

Warning: Never install from an image whose checksum does not match. Delete it, download from the official mirror again, and re-verify. If the mismatch persists on a fresh download, contact the distribution through official channels.

FAQ

Q.Which algorithm should I use?

A.Use SHA-256 whenever the publisher offers it, which is nearly universal today. SHA-1 is broken for collision resistance, and MD5 is unsuitable for security. SHA-256 is required by NIST transition guidance and remains the practical standard for ISO verification.

Q.Do I need to verify every download?

A.At minimum verify anything you will install, run with privileges, or use as a base image. For frequent, low-risk downloads you can be pragmatic, but for a fresh OS install or a container base the few seconds of verification are always worth it.

Q.If the hash matches, is the ISO definitely safe?

A.It proves the file is byte-for-byte identical to what the publisher hashed. It does not prove the publisher is trustworthy, nor that the checksum itself was not tampered with. That is why signed checksums and official HTTPS sources matter.

Q.Why does my macOS hash look different?

A.Make sure you hash the exact file you downloaded and use the same algorithm (sha256sum / shasum -a 256). A different tool or a file that was auto-extracted or converted will produce a different hash.

Q.Should I verify the ISO or the USB stick?

A.Verify the ISO first, then write it. If you want end-to-end certainty after writing, you can re-read the stick and hash the device image, though most users stop after verifying the ISO they wrote from.

References

  • NIST FIPS 180-4 – Secure Hash Standard: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf
  • NIST SP 800-131A Rev. 2 – Transitioning the Use of Cryptographic Algorithms and Key Lengths: https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
  • RFC 6234 – US Secure Hash Algorithms: https://www.rfc-editor.org/rfc/rfc6234
  • OWASP Cryptographic Storage Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html

Verify files with SHA-256

Generate and compare SHA-256 hashes for any file, entirely in your browser.

Open SHA-256 Hash Generator

A minute of verification, hours of trust

Checksum verification is cheap, fast, and catches both accidental corruption and deliberate tampering. Make it part of every OS and firmware download.

Do it locally with the SHA-256 Hash Generator - no upload, no account, no third party seeing your downloads.