How to Verify SHA-256 Hashes

Verifying a SHA-256 hash confirms that a file you downloaded is byte-for-byte identical to the file that was documented. If someone replaced the file with a modified version, the hash would not match. This is the most reliable way to check that you have the correct file before running it.

Summary

Find the SHA-256 hash on the client page under Security Verification. Compute the hash of your downloaded file using a command-line tool for your operating system. Compare the two strings character by character. If they match, the file is identical to the documented version. If they differ, do not run the file — redownload from the official source.

Windows (PowerShell)

Open PowerShell and run the following command, replacing the path with the location of your downloaded file:

Get-FileHash -Algorithm SHA256 "C:\Users\YourName\Downloads\wurst-7.55.1.zip"

PowerShell prints the hash in uppercase. Compare it to the documented hash on the client page (case-insensitive comparison is fine — SHA-256 hex output is the same regardless of case).

Windows (Command Prompt)

Windows also has a built-in certutil tool:

certutil -hashfile "C:\Users\YourName\Downloads\wurst-7.55.1.zip" SHA256

macOS

Open Terminal and run:

shasum -a 256 ~/Downloads/wurst-7.55.1.zip

If shasum is not available, use openssl:

openssl dgst -sha256 ~/Downloads/wurst-7.55.1.zip

Linux

Open a terminal and run:

sha256sum ~/Downloads/wurst-7.55.1.zip

Comparing the output

The output is a 64-character hexadecimal string. Every character must match the documented hash. Whitespace, line breaks, and case do not matter — only the hex digits do.

Example of a match:

Documented:  be6658fe86178f3e6bb9597954d9f4cb1f4336b46d89e5483a9be45483b5257f
Local:       be6658fe86178f3e6bb9597954d9f4cb1f4336b46d89e5483a9be45483b5257f
Result:      MATCH

Example of a mismatch:

Documented:  be6658fe86178f3e6bb9597954d9f4cb1f4336b46d89e5483a9be45483b5257f
Local:       a1c3e5f7890b2d4e6f8a0c2e4f6a8b0c2d4e6f8a0c2e4f6a8b0c2d4e6f8a0c2e
Result:      MISMATCH

If the hashes differ

Do not run the file.
Delete the downloaded file.
Redownload from the official source linked on the client page.
If the mismatch persists after a fresh download, treat the file as suspicious and report it via the report issue page.

Why SHA-256 and not MD5 or SHA-1

MD5 and SHA-1 are older hash algorithms with known collision vulnerabilities. A collision means two different files can produce the same hash, defeating the purpose of verification. SHA-256 has no practical collision attacks. Use SHA-256 for any file verification.

Limitations

A matching hash confirms that your file matches the documented file. It does not confirm that the documented file is safe. If the original file was malicious, the hash will match and the file will still be malicious. Hash verification is one step in a broader process — see our verification methodology for what else we check.