Check a File's SHA-256 Hash on Mac, Linux and Windows

shasum -a 256 release.tar.gz
# 51b12eb838732b786b4d45c660a974ddf3860ae09084fd293fa6e5df46581a6c  release.tar.gz

-a 256 selects SHA-256; without it, shasum uses SHA-1. openssl dgst -sha256 release.tar.gz gives the same hash in a different layout.

sha256sum release.tar.gz
# 51b12eb838732b786b4d45c660a974ddf3860ae09084fd293fa6e5df46581a6c  release.tar.gz

Many projects publish a file such as SHA256SUMS with one line per download. Check every file listed in it in one step:

sha256sum -c SHA256SUMS        # Linux
shasum -a 256 -c SHA256SUMS    # macOS
# release.tar.gz: OK

The check prints OK or FAILED per file and exits with an error code when any file fails, so it also works in scripts and CI.

certutil -hashfile release.tar.gz SHA256

Get-FileHash release.tar.gz -Algorithm SHA256

certutil works in the Command Prompt and PowerShell; Get-FileHash is PowerShell's own command. Both print the hash in a different letter case from Linux tools, which does not matter: compare the hashes case-insensitively.

import { createHash } from "node:crypto";
import { createReadStream } from "node:fs";

const hash = createHash("sha256");
for await (const chunk of createReadStream("release.tar.gz")) hash.update(chunk);
console.log(hash.digest("hex"));

import hashlib

with open("release.tar.gz", "rb") as f:
    print(hashlib.file_digest(f, "sha256").hexdigest())

Both printed the same hash as shasum and sha256sum for the test file. Read the file in binary mode in Python; text mode can change line endings and therefore the hash.

A matching hash proves the file is the one the hash describes: nothing was corrupted or swapped on the way. It does not prove who published it. If an attacker can change the download page, they can change the listed hash too. Where a project offers a signature, for example a .asc or .sig file, verify that as well, because it ties the file to the publisher's key.