When you download an operating system ISO, a cryptographic key, or a critical software patch from the internet, you must be absolutely certain that the file has not been tampered with by a malicious third party during the download process. To mathematically prove the integrity and authenticity of a file, developers provide cryptographic hashes. In Linux, the most robust and commonly used standard for verifying these hashes is the Secure Hash Algorithm 256-bit, and you can verify it using the sha256sum command.
How to Calculate a SHA256 Hash
The sha256sum utility reads the exact binary data of a file and runs it through a complex mathematical algorithm to produce a unique, 64-character hexadecimal string. If even a single invisible bit of data inside the gigabyte-sized file is altered, the resulting 64-character string will change entirely.
To calculate the hash of a file you just downloaded, open your terminal and run:
sha256sum ubuntu-24.04-desktop-amd64.isoBecause the algorithm has to process the entire file, calculating the hash for a 5-gigabyte ISO might take a few seconds. Once finished, the terminal will output the hash followed by the filename:
a1b2c3d4e5f6... (64 characters) ... ubuntu-24.04-desktop-amd64.isoHow to Verify the File Integrity
Once you have calculated the hash on your local machine, you must compare it against the official hash provided by the software developer.
- Go to the official website where you downloaded the file (e.g., the Ubuntu download page).
- Look for a link labeled “Verify your download,” “SHA256 Checksums,” or simply a long string of characters listed directly below the download button.
- Visually compare the official hash on the website against the hash outputted by your terminal. (You usually only need to check the first 5 and last 5 characters to ensure a match).
If the hashes match perfectly, your file is mathematically guaranteed to be pristine and safe to install. If they differ, the file was corrupted during download, or worse, you have downloaded a maliciously modified version and you should delete it immediately.
Automating Verification with Checksum Files
If you are downloading multiple files, visually comparing 64-character strings is tedious and prone to human error. Developers often provide a small text file (usually ending in .txt or .sha256) containing the official hashes for all their files.
Download both the large software files and the small checksum text file into the same directory. Then, use the -c (check) flag to force the utility to read the text file and automatically verify everything in the folder.
sha256sum -c official_checksums.txtThe terminal will instantly read the file, calculate the local hashes, compare them internally, and print a clear, human-readable status report:
ubuntu-24.04-desktop-amd64.iso: OK
ubuntu-24.04-live-server-amd64.iso: OKIf any file fails the check, it will loudly report FAILED instead of OK.