How to verify a file checksum on Windows

Short answer: compare the checksum of the downloaded file with the value published on the download page. PowerShell's Get-FileHash can compute it, but you have to remember the command and compare the strings by eye; a free app like Checksum Verifier does the comparison for you — paste the expected hash and get a green or red badge.

What is a checksum?

A checksum (hash) is a file's fingerprint: a short string computed from the file's entire content. Change one bit in a 10 GB image and the hash changes completely. Vendors publish MD5, SHA-1, SHA-256 or SHA-512 checksums next to their downloads precisely so you can prove that the file you received is the file they published — no corruption on the way, no silent tampering.

Method 1: PowerShell Get-FileHash

  1. Open Windows Terminal (or PowerShell) in the folder with the downloaded file and run the command for the algorithm from the download page:
Get-FileHash .\file.iso -Algorithm SHA256

The hash appears in the console; use -Algorithm MD5, SHA1 or SHA512 when the page lists a different one.

  1. Copy the printed hash and compare it with the page — character by character, ignoring case.

Pros: built into Windows, nothing to install, fine for a one-off check. Cons: you have to remember the exact command and algorithm names; the comparison is manual, and 64 similar-looking characters plus line wraps, different case (PowerShell prints uppercase, sites often lowercase) and stray spaces make a real mismatch easy to miss.

Method 2: online checksum services

Websites accept a file upload and show its MD5 or SHA-256. The catch is in the verb: your file is uploaded to someone else's server and leaves your PC. For a Linux ISO that is tolerable; for a private document, a work archive or anything under NDA it is a non-starter. Add upload size limits and services that are down exactly when you need them, and the convenience evaporates.

Method 3: Checksum Verifier — paste, compare, done

Download free — ChecksumVerifier-Setup.exe

  1. Add the downloaded file and tick the algorithm from its download page — MD5, SHA-1, SHA-256 or SHA-512, alone or several at once.
  2. Paste the expected checksum from the page into the field at the top: the comparison ignores case and extra spaces, so a hash copied straight off a webpage just works.
  3. Press “Verify” — a green “Hash matches” badge means the file is intact; a red “Hash does not match” means it differs from the published one and should not be run.

Hashing runs on your PC only: nothing is uploaded, the file never leaves the machine, and Wi-Fi off changes nothing. Files are read from disk in a stream, so even a 10 GB ISO is hashed with a flat memory footprint — no size limits and no waiting for the file to load into memory.

If the hash does not match

  1. Do not run the file. A mismatch means the bytes on disk differ from what the vendor published — the download is corrupted or was altered on the way.
  2. Re-download over a different network (or from another mirror) and verify again: most mismatches are truncated or damaged transfers, and a second attempt over a different route usually comes back intact.
  3. Check the source. If the hash still differs, compare it with the value on the vendor's official site or HTTPS page — a checksum that disagrees with an unofficial mirror is a reason to distrust that mirror entirely.

FAQ

Which algorithm should I use — MD5, SHA-1, SHA-256 or SHA-512?

Use whatever the download page publishes — most often SHA-256. MD5 and SHA-1 still appear on legacy downloads but are considered weak against deliberate tampering; for catching a corrupted transfer any of them works, for tamper protection prefer SHA-256 or SHA-512.

The hash on the website is lowercase and PowerShell prints uppercase — is that a problem?

No: checksum comparison is case-insensitive, b94d… and B94D… are the same value. Checksum Verifier ignores case and extra spaces automatically, so you can paste the hash exactly as the page shows it.

Is it normal that hashing a 10 GB ISO takes a while?

Yes — the whole file has to be read, so the duration is your disk speed, not a bug. The app streams the file instead of loading it, so memory use stays flat; queue several files and let it work in one pass.

More: how to see all devices on your Wi-Fi network and how to find and remove empty folders on Windows.

Related guides