File Checksums Windows: How to Verify & Use Them

File checksums in Windows are short, fixed-length values calculated from a file’s contents, used to verify that the file hasn’t been corrupted or tampered with. You can compute and verify checksums using built-in tools like Get-FileHash in PowerShell or certutil in Command Prompt, without installing any third-party software. This article explains what checksums are, how to generate them in Windows, and how to use them to confirm file integrity.

What Is a File Checksum?

A checksum (also called a hash) is a mathematical fingerprint of a file. It’s produced by a hash function—like MD5, SHA-1, or SHA-256—that takes the file’s binary data and outputs a fixed-length string of characters (usually hexadecimal). Even a tiny change in the file, such as flipping a single bit, produces a completely different checksum. This makes checksums useful for detecting accidental corruption during download or transfer, and for verifying that a file hasn’t been altered maliciously.

Common hash algorithms include:

• MD5 – 128-bit hash, fast but now considered cryptographically broken for security purposes; still used for quick integrity checks.
• SHA-1 – 160-bit hash, also deprecated for security due to collision attacks, but still seen in older software.
• SHA-256 – 256-bit hash, part of the SHA-2 family, widely recommended and used by most modern software distributors.

For most verification tasks, SHA-256 is the best choice because it’s secure and universally supported on Windows.

How to Get a File Checksum in Windows

Windows doesn’t have a single obvious “checksum” button, but two built-in command-line tools do the job. Here’s how to use them.

Using PowerShell (Recommended)

1. Open PowerShell: Press Win, type PowerShell, and press Enter.
2. Navigate to the folder containing the file, or use the full path. For example: cd C:\Downloads
3. Run the command: Get-FileHash .\filename.exe -Algorithm SHA256
4. The output shows the hash value and the path. You can also pipe it to a file: Get-FileHash .\filename.exe | Out-File -FilePath hash.txt

To compute multiple hashes at once, use a wildcard: Get-FileHash .\*.iso

Using Command Prompt (certutil)

1. Open Command Prompt: Press Win, type cmd, and press Enter.
2. Run: certutil -hashfile C:\path\to\file.exe SHA256
3. The hash appears on the next line. You can also redirect it to a file: certutil -hashfile file.exe SHA256 > hash.txt

Both tools support MD5, SHA-1, SHA-256, and other algorithms. For SHA-1, just replace the algorithm name in the command.

How to Verify a Checksum on Windows

Verifying a checksum means comparing the hash you calculated with the one provided by the software publisher (usually on their website or in a separate file). If they match exactly, the file is authentic and uncorrupted.

To compare manually, you can visually inspect the two strings, but that’s error-prone. A better way is to use PowerShell to compare them programmatically:

$hash1 = (Get-FileHash .\file.exe -Algorithm SHA256).Hash
$hash2 = "the_expected_hash_from_website"
if ($hash1 -eq $hash2) { "Match" } else { "No match" }

Alternatively, if you have a checksum file (e.g., SHA256SUMS), you can use the Get-FileHash output and compare it with the content of that file using a text editor or a script.

When Should You Check a File’s Checksum?

Checksums are most valuable in these scenarios:

• After downloading large files (ISOs, installers, archives) – network glitches can corrupt data silently.
• Before installing software – ensure the file hasn’t been tampered with, especially if you downloaded it from a mirror.
• After copying files to a USB drive or external disk – verify the copy is identical to the original.
• When sharing files with others – publish the checksum so recipients can confirm integrity.

Note that checksums do not prove the file is safe from malware. A malicious actor can provide a valid checksum for a malicious file. Always download from official sources and use antivirus software.

Common Problems and Mistakes

• Mixing up algorithms – An MD5 hash will never match a SHA-256 hash. Always use the same algorithm as the one provided by the source.
• Copying extra spaces or line breaks – When pasting the expected hash, make sure there are no hidden characters. Use a text editor to trim whitespace.
• Using the wrong file path – If you point the command to the wrong file, you’ll get a different hash. Double-check the path.
• Case sensitivity – Hash strings are case-insensitive in comparison, but it’s safer to compare exactly as printed.
• Large files take time – Hashing a multi-gigabyte file can take a minute or two, but it’s normal.

Alternatives to Built-in Tools

While Windows’ built-in tools are sufficient for most users, some prefer graphical interfaces. Third-party tools like HashCheck, QuickHash, or 7-Zip (which can show checksums in its file properties) offer right-click integration and batch processing. However, these are not necessary for basic verification.

For advanced users, the command-line tool fciv (from Microsoft) was once available, but it’s deprecated. PowerShell’s Get-FileHash is the modern replacement.

Frequently Asked Questions

What is the difference between MD5, SHA-1, and SHA-256?

They are different hash algorithms with different output lengths and security levels. SHA-256 is the most secure and recommended. MD5 and SHA-1 are faster but have known vulnerabilities that allow collisions (two different files producing the same hash). For integrity checks, any of them work, but for security-sensitive applications, use SHA-256.

Can I check a checksum without downloading any software?

Yes. Windows 10 and 11 include PowerShell and Command Prompt, both of which can compute hashes natively. No additional installation is required.

Why does the checksum change when I re-download the same file?

If the checksum changes, the file content changed. This could be due to a corrupted download, a different version of the file, or the server sending a modified file. If you’re downloading from the same official source and the hash doesn’t match the published one, re-download and try again.

Is a checksum the same as a digital signature?

No. A checksum is a simple hash that verifies integrity but not authenticity. A digital signature uses cryptography to prove who created the file and that it hasn’t been altered. Checksums can be forged by anyone who can modify the file and recalculate the hash.

How do I check a checksum on Windows 7?

Windows 7 doesn’t have Get-FileHash, but you can use certutil in Command Prompt, which is available in Windows 7. The syntax is the same as described above.

Related

• Share From File Explorer in Windows 10 Technical Preview
• SSD Qualities That Matter More Than Speed
• GTA Online Twitch Drops: How to Get Rewards