Verify a Download's SHA-256 Hash Against the Publisher's Value in Windows
Compute a file's SHA-256 with Get-FileHash in Windows PowerShell and compare it with a value supplied by a trusted publisher. This checks content rather than the filename. A match establishes consistency with the compared value; it is not a malware scan or a safety guarantee.
Published · Updated · FaultNote editorial policy
Who this guide is for and what to prepare
- People checking a downloaded ISO, installer, or archive
- People comparing file content after copying to another drive
What you need
- Finish the download and locate the file. You do not need to run it to verify its hash.
- Obtain SHA-256 for the same version, language, and architecture from a trusted location such as the official download page.
- Open Windows PowerShell or PowerShell with normal read access to the target file.
1. Verify the source of the expected value
Finding the same string in a search result does not establish that you have the intended distribution. Use the publisher's value for the exact product and file.
Microsoft's Windows 11 download page is one example with verification guidance. Values differ between products and languages; do not reuse a value from another release.
- Match the release, language, and architecture as well as the filename against the download page.
- Confirm that the published algorithm is SHA-256 and record its corresponding 64-character hexadecimal value.
2. Display the file's SHA-256
The path below is an example; replace it with your download location. -LiteralPath treats characters such as square brackets as part of the literal filename.
Reading a large file takes time. Avoid modifying it while the calculation runs and wait for the result.
$downloadPath = 'C:\Users\YourName\Downloads\package.zip'
Get-FileHash -LiteralPath $downloadPath -Algorithm SHA256 | Format-List Algorithm, Hash, Path- Replace $downloadPath with the target file and run the code.
- Check that Algorithm is SHA256 and Path identifies the intended file.
3. Compare the complete expected value
Compare the entire value, not just its first or last characters. The example below checks the expected value's format before comparing it.
Run this in the same PowerShell session. This comparison treats differences in letter case as equivalent.
$expectedHash = 'PASTE_THE_64_CHARACTER_SHA256_HERE'
if ($expectedHash -notmatch '^[A-Fa-f0-9]{64}$') {
throw 'Enter the exact 64-character SHA-256 from the trusted publisher.'
}
$actualHash = (Get-FileHash -LiteralPath $downloadPath -Algorithm SHA256 -ErrorAction Stop).Hash
$actualHash -eq $expectedHash- Replace PASTE_THE_64_CHARACTER_SHA256_HERE with the publisher's actual value, without surrounding labels or whitespace.
- True means a match; False means a mismatch. An error means the comparison has not completed successfully.
4. Investigate a mismatch
A mismatch means the content differs from the reference, but it does not identify the reason. Check for incomplete downloads, a different release or language, or comparing an extracted file with an archive's hash.
- Recheck the file path, published algorithm, and product details.
- Download again from the correct official source and verify the completed new file.
- If it repeatedly fails to match, leave the file unexecuted and check the publisher's update information or support channel.
5. Understand what a match establishes
A source that replaces both a file and its advertised hash can still produce a match. Trust in the reference and correct computation both matter.
Matching SHA-256 values are useful for checking content before and after a copy. That remains separate from assessing whether the original file is safe.
- Record the publisher, filename, release, and comparison result when useful.
- For copy verification, compute both values with the same algorithm and compare them.
- Before using the file, also consider its publisher, signature, and normal security checks as appropriate.
Limitations and requirements
- A matching SHA-256 does not guarantee a file's purpose or runtime behavior is safe.
- Renaming alone does not change a content hash. Extracting, recompressing, or editing can produce content different from the original distribution.
- Without a trusted expected value, a hash alone does not establish the file's provenance.
Frequently asked questions
Does True mean the file has no malware?
True means the computed value matches the supplied one. It is not a malware verdict, and the reference value's source matters.
Why do files with the same name have different hashes?
Names and content are separate. Check for different releases or languages, updates, edits, or an incomplete download.
Official sources and verification date
Sources checked: . Check the official sources below for changes to supported systems, plans and menus.