How to Verify File Integrity in Windows 11 Using the Get-FileHash PowerShell Cmdlet

When downloading operating system installation media, software installer packages, or proprietary database backups from the internet, confirming that the downloaded file has not been corrupted or maliciously modified is a mandatory security best practice. Hardware errors, interrupted connections, or man-in-the-middle attacks can silently alter file bits, resulting in installation failures or security compromises.

Historically, Windows users had to install third-party hashing utilities or wrestle with the legacy command-line tool certutil to compute checksums. Modern Windows 11 installations include the native, object-oriented Get-FileHash cmdlet in Windows PowerShell. This built-in tool supports all major cryptographic hashing standards, integrates seamlessly into automated scripts, and computes file checksums with zero third-party software dependencies. This guide explains how to use Get-FileHash in Windows 11 to generate, verify, and automate cryptographic checksum validation.

Supported Cryptographic Hash Algorithms

Cryptographic hash functions generate a unique fixed-length string of hexadecimal characters based on the exact binary contents of a file. Even changing a single punctuation mark inside a gigabyte-sized archive completely changes the resulting hash value.

The Get-FileHash cmdlet supports six standard hashing algorithms via its -Algorithm parameter:

Algorithm Name	Hash Length	Security Level	Recommended Application
SHA256 (Default)	256 bits (64 hex characters)	High (Industry Standard)	General file verification, software downloads, ISO images
SHA384	384 bits (96 hex characters)	Very High	Government and high-compliance enterprise environments
SHA512	512 bits (128 hex characters)	Maximum	Cryptographic archival, forensics, sensitive distribution
SHA1	160 bits (40 hex characters)	Deprecated (Collision vulnerable)	Legacy compatibility checks only
MD5	128 bits (32 hex characters)	Broken for security	Rapid error-checking for benign disk transfers only

By default, if you run Get-FileHash without declaring an algorithm, PowerShell automatically employs SHA256.

How to Calculate a File Hash in PowerShell

Generating a checksum for any file on your computer takes just a single command:

1. Right-click the Start button on your Windows 11 taskbar and select Terminal (or search for PowerShell).
2. Type the following command, replacing the example path with the actual file location:

   Get-FileHash -Path "C:\Users\Username\Downloads\Ubuntu-24.04-desktop.iso"

3. Press Enter.

PowerShell processes the file stream and outputs a formatted table showing the algorithm, calculated hash string, and absolute file path:

Algorithm       Hash                                                              Path
---------       ----                                                              ----
SHA256          3A1F4C20E159782B4826507A656B3A4F9827B08051E958A6311690029E...    C:\Users\...

To compute a different hash type—such as MD5 or SHA512—pass the desired name into the -Algorithm switch:

Get-FileHash -Path "D:\Backups\Database.bak" -Algorithm MD5

Comparing Checksums Automatically in PowerShell

Manually scanning a 64-character SHA256 string to compare it with a hash published on an official vendor website is tedious and prone to human error. Instead, let PowerShell verify whether the calculated hash matches the expected checksum automatically.

Enter the following one-line logical comparison command, inserting the expected vendor checksum string in quotes:

(Get-FileHash -Path "C:\Downloads\installer.exe").Hash -eq "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"

PowerShell evaluates both values. Because PowerShell comparisons are case-insensitive by default, it does not matter if the vendor provided lowercase letters while PowerShell returned uppercase characters:

• If the output returns True, the file is 100% authentic and completely identical to the source release.
• If the output returns False, the file is corrupted, incomplete, or has been tampered with. Do not execute or mount it.

Calculating Hashes for Multiple Files Simultaneously

Because PowerShell operates on pipeline objects, you can pipe file listings from Get-ChildItem into Get-FileHash to audit entire folders or directories at once:

Get-ChildItem -Path "D:\Deployments" -File | Get-FileHash -Algorithm SHA256

This command traverses the target directory and prints a clean inventory table displaying the individual SHA256 hash for every file in the folder.

Exporting Hashes to a Checksum Manifest File

To create a permanent checksum manifest file (similar to an MD5SUMS or SHA256SUMS manifest commonly used in Linux distributions):

Get-ChildItem -Path "D:\ReleasePackage" -File | Get-FileHash | Select-Object Hash, Path | Export-Csv -Path "D:\ReleasePackage\checksums.csv" -NoTypeInformation

This script logs the hash and path of every file into a lightweight CSV spreadsheet, allowing you to audit file integrity at any point in the future.

Using Get-FileHash in Windows 11 provides a fast, cryptographically robust, and native method for validating file downloads and verifying data integrity across enterprise and personal environments.