When downloading large software packages, operating system ISO images, or transferring critical backups between servers, there is always a risk of data corruption. A brief network interruption or a faulty storage drive can silently alter a few bytes of data, rendering the entire file unusable or unstable.
Worse, if you are downloading software from an untrusted source, a malicious actor might have subtly modified the file to include malware. To guarantee that a file is exactly identical to its original source, Linux administrators use cryptographic hashes. The md5sum command is one of the oldest and most widely used tools for this exact purpose.
What is an MD5 Hash?
MD5 (Message Digest algorithm 5) is a cryptographic function. When you run a file through the md5sum tool, it reads every single byte of data and performs complex mathematics to generate a unique 32-character string of letters and numbers (the “hash”).
This string acts like a digital fingerprint. If even a single period or pixel changes inside a massive 4GB file, the resulting MD5 hash will look completely different. By comparing the hash of the file you downloaded against the official hash provided by the software developer, you can definitively prove the file’s integrity.
How to Generate a Hash for a Single File
The md5sum utility is included by default in the coreutils package on virtually every Linux distribution.
To generate the fingerprint of a file, open your terminal and type md5sum followed by the path to the file.
md5sum ubuntu-22.04-desktop-amd64.iso
Press Enter. The system will read the file (which may take a few seconds for very large files) and output a string similar to this:
c9b5d2d0c24fb6a1883b27ec47b59e35 ubuntu-22.04-desktop-amd64.iso
You then visually compare that 32-character string to the official string published on the Ubuntu website. If they match exactly, your download was perfect.
How to Automatically Verify Multiple Files
Visually comparing 32 characters is tedious and prone to human error, especially if you have downloaded dozens of files. md5sum includes a feature to automate the checking process.
When software developers provide a large directory of files, they usually include a text file named something like MD5SUMS.txt. This file contains a list of every file and its correct hash.
Instead of checking them manually, you can tell the command to read the text file and verify all the files automatically using the -c (check) flag.
md5sum -c MD5SUMS.txt
The command will read the text file, locate the corresponding files in your current directory, calculate their hashes locally, and print a clear OK or FAILED status next to each file name.
Security Warning Regarding MD5
While md5sum is excellent for detecting accidental data corruption during downloads (like a dropped connection), it is no longer considered cryptographically secure against intentional, malicious tampering. Modern supercomputers can perform “collision attacks,” creating a fake, malicious file that coincidentally generates the exact same MD5 hash as the legitimate file.
For high-security verification (such as confirming the authenticity of an operating system or sensitive security software), the technology industry has moved to the SHA-256 algorithm. The process is identical, but you use the sha256sum command instead. However, for everyday file integrity checks and detecting simple download errors, md5sum remains a fast, reliable, and ubiquitous tool in the Linux ecosystem.