ThisCalculator

Everyday

sha256sum and md5sum Commands Explained

Updated · Standard formula, shown below

sha256sum and md5sum Commands Explained

The sha256sum and md5sum commands are Linux/Unix utilities that compute and verify cryptographic checksums (hashes) of files, letting you confirm data integrity or detect accidental corruption. You run them with a filename, and they output a fixed-length hexadecimal string unique to that file’s contents.

What These Commands Do

Both commands read a file and produce a message digest—a fixed-size output derived from the file’s bytes. The digest changes drastically if even one bit changes. This makes them useful for:

  • Verifying downloaded files match the publisher’s published hash.
  • Checking that a copied or transferred file wasn’t corrupted.
  • Quickly comparing two files to see if they are identical.

The key difference is the algorithm: md5sum uses MD5 (128-bit output), while sha256sum uses SHA-256 (256-bit output).

How to Use Them

Basic syntax is the same for both:

md5sum filename
sha256sum filename

Output looks like:

d41d8cd98f00b204e9800998ecf8427e  filename

The hash is followed by two spaces and the filename. For multiple files, each gets its own line.

Common options include:

  • -c or --check: read a file containing hashes and filenames, then verify each.
  • -b: treat input as binary (default on most systems).
  • --quiet: only show failures when checking.

Verifying a File Against a Known Hash

To verify a download against a published hash, you typically do:

  1. Download both the file and its .sha256 (or .md5) checksum file.
  2. Run sha256sum -c file.sha256 in the same directory.
  3. Read the output: filename: OK means match; FAILED means mismatch.

If you only have the hash string (e.g., from a website), run sha256sum file and compare the output manually—or use a command like echo "hash filename" | sha256sum -c.

MD5 vs SHA-256: Which Should You Use?

For most purposes, use sha256sum. MD5 is cryptographically broken—researchers have demonstrated collisions (two different files with the same MD5 hash) since 2004. This means an attacker could craft a malicious file that matches a legitimate file’s MD5. SHA-256 is currently collision-resistant and is the standard for integrity checks.

However, MD5 is still seen in legacy systems, old checksum files, or when compatibility is needed. For casual, non-security checks (like ensuring a copy didn’t corrupt), MD5 is often fine, but SHA-256 is just as easy to use and more future-proof.

Common Pitfalls and Misconceptions

Myth: “The hash tells me the file is safe.” A matching hash only confirms the file is exactly what the publisher released—it doesn’t guarantee the publisher is trustworthy or that the file isn’t malware.

Line endings and whitespace matter. On Windows, text files may have CRLF line endings; hashing the same file with different line endings gives different hashes. Always hash the exact bytes you received.

Check the algorithm. A SHA-256 hash is 64 hex characters; MD5 is 32. Don’t try to verify a SHA-256 file with md5sum—you’ll get a mismatch.

Filename in output. If you copy-paste a hash from a website, ensure no extra spaces or newline characters sneak in.

Alternatives and Related Tools

Other checksum tools include:

  • sha1sum – SHA-1, also deprecated due to collision attacks.
  • sha224sum, sha384sum, sha512sum – other SHA-2 variants.
  • b2sum – BLAKE2, a fast and secure alternative.
  • cksum – CRC checksum, not cryptographically secure but quick for error detection.

On Windows, Get-FileHash in PowerShell provides similar functionality. On macOS, md5 and shasum are available.

Frequently Asked Questions

Can I use these commands to check if two files are identical?

Yes. If the hashes match, the files are almost certainly identical. The probability of a collision is astronomically small for SHA-256. However, a direct byte-by-byte comparison (cmp) is definitive and doesn’t require reading entire files.

Why does the hash change when I move a file?

It shouldn’t. Moving a file within the same filesystem doesn’t alter its contents. If the hash changes, the file was modified during transfer (e.g., FTP in ASCII mode changing line endings) or the file was corrupted.

What does “FAILED open or read” mean?

It means the file specified in the checksum file doesn’t exist or can’t be read. Check the filename, path, and permissions.

Is it safe to use MD5 for non-security checks?

For accidental corruption detection, yes—MD5 will catch random bit flips. But if an attacker could deliberately craft a collision, don’t rely on it. Use SHA-256 when in doubt.

How do I generate a checksum for all files in a directory?

Use a wildcard: sha256sum * will hash every file in the current directory. To include subdirectories, use find . -type f -exec sha256sum {} +.

What’s the difference between sha256sum and openssl dgst -sha256?

Both compute the same SHA-256 hash. The output format differs slightly, but the underlying result is identical. openssl dgst offers more algorithms and options, but sha256sum is simpler and designed for file verification.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.