Before You Double-Click: How to Prove a Download Is Actually What It Claims to Be

Every download is a claim. The page says this is VLC 3.0.21, or the latest Nvidia driver, or the tax software your accountant recommended. Your job is not to believe the claim — it is to check it. That is the entire idea behind a checksum, and in 2026 it is the cheapest security measure most people still skip.

A filename is not evidence

Anyone can name a file Setup-Official-2026.exe. Anyone can buy a domain that looks close enough at a glance, spin up a landing page with a stock photo of a smiling support agent, and let a language model write the copy. Search results do not protect you, because the bad pages are optimized for the same queries as the good ones. A padlock in the address bar only means the connection is encrypted — it says nothing about who is on the other end.

A cryptographic hash is different. It is a fingerprint computed from the file's exact contents. Change one byte and the fingerprint changes completely. If the hash you compute on your machine matches the hash the developer published, the file you hold is byte-for-byte the file they shipped. No trust required, just arithmetic.

Find the hash at the source, not the mirror

This part matters more than the command you type later. Open the vendor's own site, navigate to the download page yourself, and look for a link labeled checksums, SHA-256, hashes, or release notes. Many projects publish a single text file listing every build.

Two things to watch for:

• The hash has to come from a different place than the file. A hash printed next to a download button on an untrusted mirror proves nothing — whoever swapped the installer could swap the hash too.
• Long hashes get truncated by copy-paste. Grab the whole string. A 64-character SHA-256 digest that arrives as 63 characters will fail verification and send you chasing a problem that does not exist.

For anything that touches your system deeply — operating system images, encryption tools, router firmware — look for a GPG signature instead. That is a hash wrapped in a cryptographic signature, so it proves both the contents and who signed off on them.

Checking a file on Windows

The command line is faster than any third-party tool. Open Terminal or PowerShell and run:

certutil -hashfile "C:\Users\you\Downloads\setup.exe" SHA256

Or in PowerShell, which formats the output more cleanly:

Get-FileHash -Algorithm SHA256 .\setup.exe

Compare the result to the published value character by character. Case does not matter. If your vendor only lists MD5, treat that as a mild yellow flag — MD5 has been broken for years and is kept around mostly out of habit.

Checking a file on macOS

Open Terminal and point it at the file:

shasum -a 256 ~/Downloads/setup.dmg

For older SHA-1 listings, drop the -a 256. For a GPG-signed release, install GPG Suite or use Homebrew, import the developer's public key, and run gpg --verify file.sig file — a good signature prints a clear confirmation line.

Checking a file on Linux

Most distros ship the tools already:

sha256sum ./image.iso

If you have the vendor's checksum file, save it alongside the download and let the tool do the comparison for you:

sha256sum -c SHA256SUMS

The output reads OK or FAILED per file, which removes eyeball fatigue entirely. For signed checksum files, gpg --verify SHA256SUMS.sig SHA256SUMS first, then run the check against the verified list.

A rule you can actually follow

Verifying everything is unrealistic. Verifying nothing is how people end up with a credential stealer wearing an installer's clothes. Use a tiered rule:

1. Always verify: operating system images, disk utilities, password managers, VPN clients, firmware, anything requesting administrator rights on a machine that holds financial or family data.
2. Verify when the source is unfamiliar: a GitHub release page, a niche utility recommended in a forum thread, a driver from a manufacturer's regional site.
3. Skip only when the app updates itself: in-app updaters that fetch over TLS from a vendor endpoint are a different threat model, and re-downloading by hand is not the fix.

When the hash does not match

Do not run the file. Delete it, empty the trash, and go back to the vendor's site typed by hand rather than clicked from a search result. A mismatch is not always malice — interrupted downloads and browser extensions do corrupt files — but you have no way to tell the difference from where you are standing, so treat it as a stop sign.

A single failed hash check costs you five minutes. The alternative costs a lot more than that.