implbits

File hash questions, answered

Twelve questions, each answered in its first sentence, with the guide to read if you want the long version.

Checking a hash

  • How do I check a file's hash on Windows?

    Use Get-FileHash in PowerShell; it is built into Windows 10 and 11. Open PowerShell in the folder that holds the file and run:

    WindowsPowerShell
    Get-FileHash .\file.iso -Algorithm SHA256

    Microsoft's reference says SHA256 is the default when -Algorithm is left out. From Command Prompt, certutil -hashfile file.iso SHA256 gives the same value. The Windows walkthrough for Get-FileHash, certutil and File Explorer adds a one-line way to compare the result.

  • How do I check a hash on a Mac?

    Use shasum -a 256 in Terminal, followed by the file. Type the command and a space, drag the file into the window, and press Return.

    macOSTerminal
    shasum -a 256 ~/Downloads/file.dmg

    Do not leave out -a 256. The shasum documentation lists SHA-1 as the default, so plain shasum prints a 40-character SHA-1 instead of the SHA-256 most publishers list.

  • How do I check a hash on Linux?

    Use sha256sum, which is part of GNU coreutils. If the project ships a checksum file, -c checks every file it lists in one go. This is a real run on Ubuntu 22.04:

    LinuxTerminal
    sha256sum -c SHA256SUMS
    Output
    hello.txt: OK

    The coreutils manual notes that -c exits with a nonzero status if any file fails, and that --ignore-missing skips listed files you did not download.

  • Which hash should I use?

    SHA-256, whenever the publisher lists it. MD5 and SHA-1 still catch accidental damage, but practical collisions exist for both, so they cannot rule out a deliberately swapped file. If a page offers several values, compare the strongest one you can compute.

    If the only value on offer is an MD5, check it anyway: it will still catch a corrupted or truncated download. Then treat the match as proof of an intact file, and nothing more.

When hashes do not match

  • Why doesn't my hash match the one on the website?

    Usually because of something ordinary: the wrong algorithm, a different version or edition of the file, or a download that did not finish. Check the length of the published value first. 64 characters means SHA-256, 40 means SHA-1 and 32 means MD5, so a length mismatch tells you that you ran the wrong algorithm. Our list of the seven usual causes of a checksum mismatch goes through the rest in order.

  • Do capital and lower-case letters matter?

    No. A hash is a hexadecimal number, and AB12 and ab12 are the same value. Windows prints hashes in capitals, while macOS and Linux print lower case. Tools that compare for you, such as sha256sum -c or PowerShell's -eq, ignore the difference.

  • Does a mismatch mean the file has malware?

    Not necessarily, but do not run it. Rule out the innocent causes first, then download the file again from the official site. If a fresh copy still fails against a value you trust, treat the file as possibly tampered with. This is what a failure looks like in the same Ubuntu run, after one character in the file was changed:

    Output
    hello.txt: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
  • The hash matches. Is the file safe?

    It is unchanged, which is a different question. A match proves your file is byte for byte the file the published value describes. It does not prove the publisher is trustworthy, or that the value itself came from the publisher. For that, check a signed checksum file where the project offers one, and keep your usual malware protection switched on.

HashTab

  • Where did HashTab go?

    It was discontinued. Archived copies show the product page in its usual form until October 2021, and replaced by a redirect by November 2021. This site is not affiliated with Implbits Software, LLC, which published it.

    The domain kept its old addresses, which is why links in old forum threads and install guides still lead here. The answers on this page are written for the tools people use now.

  • Can I download HashTab here?

    No. This site does not distribute HashTab or point to copies of it. The built-in commands above do the same job on every system with nothing to install.

  • My old HashTab tab shows no hashes. Why?

    The original support page had a one-line answer: open Settings on the File Hashes tab and make sure at least one hash algorithm is selected. The archived 2017 support page also notes that HashTab had no app icon; it only appeared as a tab under right-click, Properties.

  • What replaces HashTab's File Hashes tab?

    On Windows, OpenHashTab is the closest match: it adds hashing to the file Properties window. HashCheck Shell Extension and 7-Zip's right-click menu are other options, and on Linux, GtkHash adds a tab to several file managers. Our comparison of file hash checkers for every system lists each one's systems, price, algorithms and main limitation.

Related reading