How to Verify File Integrity

Problem

You downloaded a large file and want to confirm it is identical to the original, with no corruption or modification.

Prerequisites

• Understanding of hash functions
• Ability to run a hashing tool

Steps

1. 1. Obtain the expected hash

   Download the official hash value from a trusted source, typically published alongside the file on the official website. The hash is usually SHA-256 or SHA-512. Verify that the hash itself comes from a trusted channel (HTTPS, signed page).

   Input

   official SHA-256: a1b2c3...

   Output

   expected hash recorded

2. 2. Compute the hash of your file

   Run a SHA-256 hash tool on the downloaded file. The tool reads the file and produces a 64-character hex digest. Even a single bit change in the file produces a completely different hash.

   Input

   downloaded-file.iso

   Output

   computed: a1b2c3...

3. 3. Compare the hashes

   Compare the computed hash with the expected hash. If they match exactly, the file is intact. If they differ, the file is corrupted or tampered with; delete it and re-download. Use a constant-time comparison in code to avoid timing attacks.

   Input

   expected: a1b2... | computed: a1b2...

   Output

   MATCH ✓

Expected result

Confirmation that the downloaded file is byte-for-byte identical to the original.

Common errors

Comparing only part of the hash

Compare the entire hash string. A partial comparison can miss differences in the unchecked portion.

Getting the hash from the same server as the file

If the server is compromised, both the file and the hash could be tampered. Get the hash from an independent trusted source or a signed release.

Troubleshooting

• If hashes differ, re-download the file. If they still differ, the source may be corrupted.
• Use SHA-256 or stronger; MD5 and SHA-1 are broken for integrity against intentional tampering.

Security limits

• Hash verification detects accidental corruption and non-targeted tampering. For adversarial tamper detection, the hash must come from a trusted independent source.
• All hashing is local.