How to Check and Verify File Checksums on Mac Using Terminal (SHA-256 and MD5)

When downloading software installers, disc images (.dmg or .iso files), disk backups, or developer code archives from the web, ensuring file integrity and authenticity is vital for system security. If a download is prematurely interrupted by network packet loss, files can become corrupted and cause installation crashes. Even more critically, malicious third parties occasionally compromise distribution mirrors to inject backdoors or trojans into legitimate software packages.

To verify that a downloaded file is completely uncorrupted and identical to the original developer release, publishers provide cryptographic checksums—unique fixed-length alphanumeric digital fingerprints calculated using hashing algorithms like SHA-256, SHA-1, or MD5. macOS includes powerful, native command-line utilities—specifically shasum and md5—that allow you to compute and compare cryptographic hashes directly in Terminal without installing third-party verification tools. This guide explains how to calculate, inspect, and automatically verify checksums on your Mac.

Why SHA-256 Has Replaced MD5 for Security Verification

Understanding cryptographic hash algorithms ensures you apply the correct verification standards:

• MD5 (Message Digest 5): Generates a 128-bit hash. While historically popular for verifying that a file was not damaged during transfer, MD5 is cryptographically broken and vulnerable to collision attacks (where two different files produce identical hash strings). It remains useful strictly for basic corruption checks.
• SHA-1 (Secure Hash Algorithm 1): Generates a 160-bit hash. Like MD5, SHA-1 is now deprecated for high-security applications due to known theoretical collision exploits.
• SHA-256 (SHA-2 Family): Generates a 256-bit cryptographic digest. SHA-256 represents the modern global standard for software integrity, digital certificates, and open-source release validation, offering virtually unbreakable resistance against intentional collision tampering.

Step 1: Calculating SHA-256 Checksums in macOS Terminal

To compute the modern SHA-256 hash of any downloaded file on your Mac:

1. Launch Terminal by pressing Command + Space, typing Terminal, and pressing Return.
2. Type the following command followed by a space, but do not press Enter yet:

   shasum -a 256 

3. Drag and drop the target file from Finder directly into the Terminal window. macOS automatically populates the exact absolute path to the file:

   shasum -a 256 /Users/username/Downloads/installer.dmg

4. Press Return to execute the hashing algorithm.

Terminal will calculate the mathematical digest across every byte of the file and display a 64-character hexadecimal hash followed by the filename:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  installer.dmg

Compare this generated string against the official SHA-256 fingerprint published on the developer’s website or GitHub releases page. If even a single character differs, the file has been altered or corrupted.

Step 2: Calculating Legacy MD5 Checksums

If a legacy software provider only publishes an MD5 hash, you can generate it using Apple’s native md5 command:

md5 /path/to/downloaded_file.iso

Terminal outputs a concise 32-character hexadecimal string:

MD5 (/path/to/downloaded_file.iso) = d41d8cd98f00b204e9800998ecf8427e

Step 3: Calculating SHA-512 Checksums for Maximum Assurance

For ultra-secure system distributions and cryptographic payloads requiring 512-bit security:

shasum -a 512 /path/to/security_firmware.bin

This command outputs a 128-character digest representing maximum cryptographic entropy.

Step 4: Automating Verification Using Official Checksum Files

Manually scanning 64-character strings character by character is tedious and vulnerable to oversight. Many software vendors provide an accompanying text file (such as SHA256SUMS.txt). You can instruct Terminal to verify the file automatically:

1. Ensure the downloaded installer and the official SHA256SUMS.txt file reside in the same folder (e.g., your Downloads folder).
2. Navigate into the directory within Terminal:

   cd ~/Downloads

3. Run the automatic validation check:

   shasum -a 256 -c SHA256SUMS.txt

Terminal parses the expected checksum, computes the local file’s hash, and outputs an unmistakable confirmation:

installer.dmg: OK

If any file fails the check, Terminal alerts you with installer.dmg: FAILED, indicating that the download should be immediately quarantined and deleted.

Mastering native checksum verification in macOS Terminal provides complete confidence that downloaded binaries, disc images, and software packages remain authentic and untampered.