KN Know Zone Lab
File Integrity

How to Verify a SHA-256 Checksum in PowerShell

Know Zone Lab · Updated 2026-07-19 · 4 min read
How to Verify a SHA-256 Checksum in PowerShell
SummaryTo verify a SHA-256 checksum in PowerShell, run `Get-FileHash -LiteralPath 'C:\Downloads\release.iso' -Algorithm SHA256`, replacing the example path with the actual file. Compare the complete `Hash` value with the SHA-256 value published through the software maker's trusted channel. They must match character for character; letter case is irrelevant. A match confirms identical file content to that reference hash, but it does not prove the publisher or software is safe.
Contents

Compute the hash from the exact file path

Open PowerShell and run:

Get-FileHash -LiteralPath 'C:\Downloads\release.iso' -Algorithm SHA256

Replace the example path with the actual downloaded file. The command is read-only: it computes a hash and returns the algorithm, hash value, and path. Compare the entire result with a SHA-256 checksum obtained from the publisher's trusted official channel.

A checksum is not a vibe check. One character different means the values do not match.

Run the command in an ordinary PowerShell session; administrator rights are not needed merely to read a file you already have permission to access. If access fails, investigate the path and permissions instead of elevating the shell by habit.

Confirm the file before hashing

Use an exact path and inspect it:

Get-Item -LiteralPath 'C:\Downloads\release.iso' | Format-List FullName, Length, LastWriteTime

This confirms which file PowerShell will read. File size and timestamp are useful context, not substitutes for the published checksum.

-LiteralPath treats square brackets and other wildcard characters as ordinary filename characters. The file-integrity guides prefer it when the task targets one known file. It does not correct a typo, so read the FullName output.

Read the result as structured output

For a compact view:

Get-FileHash -LiteralPath 'C:\Downloads\release.iso' -Algorithm SHA256 |
    Format-List Algorithm, Hash, Path

Get-FileHash returns an object. Format-List changes display only; it does not change the file or hash.

Current Microsoft documentation states that SHA-256 is the cmdlet's default, but specifying -Algorithm SHA256 makes the intended comparison explicit. SHA-256 output is 256 bits, conventionally displayed as 64 hexadecimal characters because each hex character represents four bits: 256 ÷ 4 = 64.

Uppercase and lowercase hex letters represent the same value. Every hexadecimal character must otherwise match. Do not trim a prefix or suffix unless the source clearly labels it as formatting rather than part of the hash.

Obtain the reference separately

Get the checksum from the software maker's official HTTPS download or release page, signed release metadata, or another authenticated channel the publisher identifies. Avoid copying both the file and its hash from the same untrusted mirror; an attacker can replace both.

Confirm that the reference belongs to the exact:

Two nearby download rows can have similar names and entirely different bytes. Hashing the correct file against the wrong release value produces a legitimate mismatch and a deeply unhelpful afternoon.

Treat a mismatch as a stop signal

If values differ:

  1. Do not execute, mount, install, or share the file.
  2. Verify the path and algorithm.
  3. Confirm the published hash is for the same package.
  4. Compute the hash again.
  5. If it still differs, follow your security process and obtain a fresh copy from a trusted source.

Do not attempt to “fix” the hash, rename the file, or keep trying installers. A hash describes the current bytes; it is not a password the file can be persuaded to accept.

Deletion can be irreversible and may conflict with incident-response procedures, so this guide does not issue a delete command. Quarantine or evidence-preservation requirements belong to the relevant security policy.

Understand what a match proves

A match provides strong evidence that your file's bytes equal the bytes represented by that checksum. It can catch download corruption or unintended modification.

It does not prove:

Code signing, package signatures, verified publisher identity, security scans, release notes, and organizational approval answer separate questions.

Save the trusted checksum or release page with your deployment record when reproducibility matters. A future reviewer should be able to identify the reference, algorithm, package, and verification date without reconstructing the entire download session from browser history.

Before extracting a downloaded archive, follow the safe ZIP extraction guide and use a new destination folder. Matching bytes are a useful checkpoint. They are not permission for the file to redecorate the computer.

FAQ

Does Get-FileHash use SHA-256 by default?

Yes in current supported PowerShell documentation, but stating `-Algorithm SHA256` makes the intent visible and avoids relying on memory or an assumed default. The command returns an object containing the algorithm, hash, and path. Verify that the displayed path is the file you intended, especially when similarly named downloads or duplicate folders exist.

Are SHA-256 hashes case-sensitive?

Hexadecimal hash text may be displayed with uppercase or lowercase letters, and letter case does not change the underlying value. Compare all characters after removing only formatting spaces that the trusted publisher explicitly uses. Do not ignore missing digits, prefixes, or punctuation without understanding the published format. SHA-256 output should contain 64 hexadecimal characters.

What if the SHA-256 checksum does not match?

Do not run, mount, install, or distribute the file. Confirm you used the correct algorithm, release, platform, architecture, and publisher hash, then compute it again from the intended path. If it still differs, delete or quarantine the file according to your security process and download again from a trusted official source. A mismatch is not repaired by renaming.

Does a matching checksum mean a file has no malware?

No. It shows that the file content matches the content represented by the reference hash. If the trusted source was compromised, the publisher supplied a malicious file, or you copied the hash from the same untrusted page as the file, both can match. Verify source authenticity, signatures where available, security guidance, and reputation separately before executing content.

Should I use MD5 or SHA-1 for download verification?

Use the algorithm the trusted publisher specifies, but prefer a modern secure hash such as SHA-256 when a trustworthy SHA-256 reference is available. Current Microsoft documentation warns that MD5 and SHA-1 are no longer considered secure against attack and should not protect files from tampering. Never compare a SHA-256 result with a reference generated by another algorithm.