How to Verify a Minecraft Client Hash Before Running It

Verifying a SHA-256 hash before running a client file is a small step that prevents large problems. This article covers the practical workflow: computing the hash of a downloaded file, comparing it against the documented hash, and what to do when the two do not match.

Summary

Find the documented SHA-256 hash on the client page. Compute the hash of your downloaded file using a one-line command. Compare the two strings. If they match, the file is the documented version. If they do not, do not run the file — redownload from the official source.

Why this matters

A client .jar is executable code. If someone replaces the file with a modified version — a common attack on popular downloads — the modified file behaves differently from the original. It may include additional code you did not expect. The SHA-256 hash is the simplest way to confirm that the file you have is byte-for-byte the same as the file that was documented.

Step 1 — Get the documented hash

On the client page in our database, find the Security Verification section. The SHA-256 value is a 64-character hexadecimal string. Copy it to a text file or keep it visible.

Example:

be6658fe86178f3e6bb9597954d9f4cb1f4336b46d89e5483a9be45483b5257f

Step 2 — Compute the local hash

Windows (PowerShell)

Get-FileHash -Algorithm SHA256 "C:\Users\YourName\Downloads\wurst-7.55.1.zip"

Windows (Command Prompt)

certutil -hashfile "C:\Users\YourName\Downloads\wurst-7.55.1.zip" SHA256

macOS

shasum -a 256 ~/Downloads/wurst-7.55.1.zip

Linux

sha256sum ~/Downloads/wurst-7.55.1.zip

Step 3 — Compare

The output is a 64-character hexadecimal string. Case does not matter — uppercase and lowercase values represent the same hash. Whitespace and line breaks do not matter. Only the hex characters must match.

Example of a match:

Documented:  be6658fe86178f3e6bb9597954d9f4cb1f4336b46d89e5483a9be45483b5257f
Local:       be6658fe86178f3e6bb9597954d9f4cb1f4336b46d89e5483a9be45483b5257f
Result:      MATCH

Step 4 — If the hashes do not match

Do not run the file.
Delete the downloaded file.
Redownload from the official source linked on the client page.
Compute the hash of the new download.
If the mismatch persists, report it via the report issue page.

What the hash does not tell you

A matching hash means your file is the documented file. It does not mean the documented file is safe. If the original file contained malicious code, the hash will match and the file will still be malicious. Hash verification confirms identity, not safety.

For a broader understanding, see our VirusTotal reading guide and the verification methodology.

Practical habits

Always verify the hash before running a client file for the first time.
Save the hash values you use so you can quickly re-check future downloads.
After updating a client, re-verify the hash. Updates change the file.
Store a copy of the verified file so you can restore it if a later download differs.