The Importance of File Integrity
When you download a large software package—especially an operating system ISO, a firmware update for your motherboard, or a sensitive cryptographic tool—you need to know that the file on your hard drive is exactly the same as the file on the developer’s server.
If the file was corrupted during a slow download, installing it could crash your system. More dangerously, if the file was intercepted and modified by a malicious actor (a “man-in-the-middle” attack), you could be installing a virus disguised as legitimate software.
To prevent this, developers provide a “hash” or “checksum” on their download page. This is a long string of letters and numbers generated by a mathematical algorithm (like SHA-256). If even a single byte of the downloaded file is altered, the resulting hash will be completely different.
You do not need to download sketchy third-party tools to verify these hashes. Windows 11 includes a powerful, built-in command-line utility called certutil that can calculate the exact checksum of any file instantly.
Step 1: Locating the Developer’s Hash
Before you check your file, you need the original mathematical hash to compare it against.
Navigate to the website where you downloaded the file. Look for a section labeled “Checksums,” “Hashes,” “Verify your download,” or simply a string of text next to the download button labeled “SHA256.”
Copy that long string of text to your clipboard or keep the webpage open.
Step 2: Understanding the certutil Syntax
The certutil command is primarily used for managing Windows certificate authorities, but it includes a specific flag for hashing files.
The Syntax:
certutil -hashfile [Path to File] [Algorithm]
- Path to File: The exact location of the file you want to check on your hard drive.
- Algorithm: The mathematical formula you want to use. The most common are
MD5(outdated/insecure),SHA1(outdated), andSHA256(the modern standard).
Step 3: Calculating the File Hash
Open the Command Prompt (click Start, type cmd, and press Enter).
Let’s assume you downloaded a Linux installation ISO to your standard Downloads folder, and the developer provided a SHA-256 hash.
Type the command, followed by the path to your file, and the algorithm you want to use:
certutil -hashfile "%USERPROFILE%\Downloads\ubuntu-22.04.iso" SHA256
(Tip: Instead of typing the long file path, you can simply type certutil -hashfile , drag the file directly from File Explorer into the Command Prompt window to auto-fill the path, type a space, and add SHA256).
Step 4: Comparing the Results
Press Enter. Depending on the size of the file, it may take a few seconds for the system to process the mathematics.
The Command Prompt will output something that looks like this:
SHA256 hash of C:\Users\YourName\Downloads\ubuntu-22.04.iso:
a433e5361099bc1164916a04bf5df0ec464871f308a3d537f191b2bd8fbabce3
CertUtil: -hashfile command completed successfully.
Visually compare the long string of numbers and letters to the hash provided on the developer’s website.
- If they match perfectly: The file is pristine. It is exactly what the developer uploaded, and it is safe to install.
- If they are different: Do not open the file. Delete it immediately. The download was either corrupted or compromised.
Step 5: Verifying Older Algorithms
While SHA-256 is the modern standard, you might occasionally download older software where the developer only provided an MD5 hash.
You can easily switch the algorithm by changing the final word in the command. MD5 hashes are much shorter and faster to calculate.
certutil -hashfile "%USERPROFILE%\Downloads\old-software.exe" MD5
Always use the algorithm that matches the hash provided by the developer.