Always ToolsHow to Verify an MD5 Checksum on Windows, macOS, and Linux
A checksum is a short fingerprint computed from a file's contents. Publishers list MD5 (or SHA-256) checksums next to downloads so you can confirm the file arrived intact — not corrupted in transit and not tampered with. An MD5 checksum is 32 hexadecimal characters, and the same file always produces the same value.
Windows: CertUtil
Windows ships certutil, which computes several hash algorithms. Open Command Prompt (or PowerShell) and run:
certutil -hashfile "C:\Users\you\Downloads\ubuntu.iso" MD5
The output prints the digest followed by "CertUtil: -hashfile command completed successfully." For SHA-256, replace MD5 with SHA256.
macOS
macOS has the md5 command built in. Open Terminal and run:
md5 /path/to/file # or SHA-256: shasum -a 256 /path/to/file
Linux
Use md5sum on any Linux distribution. sha256sum works the same way for SHA-256.
md5sum /path/to/file # or SHA-256: sha256sum /path/to/file
How to verify a downloaded file
- Download the file and note the checksum the publisher lists next to it.
- Compute the checksum of your copy with one of the commands above.
- Compare the two values. A match means the file is intact; a mismatch means the download was corrupted or altered — delete it and re-download.
Comparison is case-insensitive: 5D41402ABC4B2A76B9719D911017C592 equals 5d41402abc4b2a76b9719d911017c592.
MD5 or SHA-256?
| MD5 | SHA-256 | |
|---|---|---|
| Digest length | 128 bits (32 hex chars) | 256 bits (64 hex chars) |
| Security | Broken: collision attacks exist | No practical attacks known |
| Use for | Detecting accidental corruption, legacy systems | Security-sensitive integrity checks, signatures |
MD5 remains fine for catching an interrupted download, but any time you care about tampering, use SHA-256. Many publishers now list only SHA-256.
FAQ
Is MD5 secure for checksums?
MD5 is fine for detecting accidental corruption such as a broken download, but it is not secure against deliberate tampering because collision attacks exist. Use SHA-256 when security matters.
How do I verify a downloaded file?
Compute the checksum of the downloaded file and compare it with the value published by the vendor. If the two match, the file arrived intact. If they differ, re-download the file.
What is the difference between MD5 and SHA-256?
MD5 produces a 128-bit digest and is considered cryptographically broken for security purposes. SHA-256 produces a 256-bit digest and is the recommended choice for integrity verification.