file.wiki

Check a file hash

You downloaded an installer and you want to know what it is before you run it. Paste its SHA-256 hash, or the file name, and we will tell you which program and version it belongs to. Everything is matched against 10,550 installers taken from publisher manifests, current releases and past versions alike.

How to get the hash of a file

Windows · PowerShell

Get-FileHash "installer.exe" -Algorithm SHA256

Windows · Command Prompt

certutil -hashfile "installer.exe" SHA256

macOS · Linux

shasum -a 256 "installer.exe"

Everything runs in your browser. The file never leaves your computer and we never receive the hash, because the index is matched locally.

What a match does and does not prove

  • A match means the file you have is byte-for-byte the installer the publisher declared for that version. Nobody tampered with it in transit and it is not a repackaged copy.
  • A match does not mean the software is safe. It means it is authentic. A publisher can ship something you would rather not install, and the hash will still match.
  • No match means we do not have it on record, nothing more. We index 221 programs, which is a small fraction of all software. Check the publisher's own download page.

Checking more than one file, or automating it? The whole index is downloadable as a free CSV and JSON dataset.

How we verify everything else

Common questions

How do I check the checksum of a file on Windows?
You do not need to install anything for this. In PowerShell, Get-FileHash "installer.exe" -Algorithm SHA256 prints it. From the ordinary Command Prompt, certutil -hashfile "installer.exe" SHA256 does the same and has been in Windows for decades, which is useful on a machine where PowerShell is restricted by policy. On macOS or Linux, shasum -a 256 gives you the same string.
Do I need a checksum checker program?
No, and it is worth saying plainly because the search results for one are full of downloadable utilities. Every operating system already computes SHA-256 from a single built-in command. Installing an unknown tool in order to establish whether a download can be trusted is a strange trade, and the box above matches the hash you get against the installers we hold without the file leaving your computer.
What is the difference between a checksum and a hash?
In everyday use the words are swapped freely, but the distinction matters here. A classic checksum such as CRC32 is built to catch accidental damage, a truncated download or a bad disk, and it is easy to construct a different file with the same value on purpose. A cryptographic hash like SHA-256 is built so that nobody can do that, which is why publishers use it and why it is the only kind worth comparing when the question is whether a file was tampered with.
The hashes are different. What does that mean?
That the file you have is not the file we recorded. That can be innocent, because a publisher may have rebuilt an installer under the same version number, or because your copy is an older release than the one on record. It can also mean the download was modified or came from somewhere other than the publisher. Either way it is a reason to go back to the official URL, which is listed on every program page here, rather than run what you have.
What does it mean when there is no match at all?
Only that we have no record of it, which is not a verdict. Our archive covers the programs indexed on this site and the versions their manifests published, which is a small fraction of all Windows software. A file we do not know is not thereby suspicious.