How to Verify a Downloaded File Against a Checksum on Windows

When you download anything from the internet — an installer, an ISO, a command-line tool, a backup archive — the publisher often lists a checksum next to the download link. The point of that checksum is for you to compute the same hash on the file you received and confirm the two match: proof that the file wasn't corrupted in transit and wasn't tampered with somewhere between the publisher and your hard drive.

The catch is that Windows doesn't make computing that hash particularly convenient. There's no right-click "verify checksum" option in File Explorer, no progress bar, no compare-against-this-value field. You're expected to drop into a terminal, run a command, and compare two long strings of hex characters by eye.

#Why verifying downloads matters — especially for unsigned files

Modern Windows installers from major vendors are usually code-signed. The signature is an embedded cryptographic stamp that Windows verifies automatically when you run the file: any change to a single byte invalidates it, and the publisher's identity is shown in the UAC prompt. For signed downloads, integrity is checked for you whether you ask or not.

Unsigned downloads have none of that protection. If the file is corrupted, swapped on a mirror, replaced by a compromised CDN, or modified by something between you and the server, Windows can't tell — it has nothing to compare against. The only thing that can tell is the checksum the publisher posted on their own website, served over HTTPS, computed before they uploaded the file. Compare that value to the hash of the file you actually received and a mismatch means the file is not what the author shipped.

A lot of legitimate, widely used software is distributed unsigned:

• Open-source binaries from GitHub releases, project websites, and SourceForge mirrors
• Linux ISO images and other operating-system installers
• Portable apps that ship as a ZIP rather than a signed installer
• Command-line tools, build tools, and language runtimes distributed as raw executables
• Security and forensics tools where the binary is built fresh for each release
• Backup and archive files retrieved months or years after they were created

Any of these can — and do — get corrupted, mirror-swapped, or tampered with. Verifying against a published checksum is the standard defense, and for a signed file it's a useful second check on top of the signature, especially for installers that will run with administrator rights.

The reason most people skip this step most of the time is friction. The checksum is sitting right there on the download page; the file is sitting right there in your Downloads folder; and the gap between them is "open a terminal and remember the right syntax". Close that gap and verification becomes the default.

#The built-in options

Get-FileHash "C:\Users\you\Downloads\installer.exe" -Algorithm SHA256

certutil -hashfile "C:\Users\you\Downloads\installer.exe" SHA256

#The practical solution: CopyFilenames

CopyFilenames adds a configurable Copy Filenames option to File Explorer's right-click menu. Copy SHA-256 Checksum is one of its standard commands, sitting on the menu out of the box.

Most download pages already have a one-click copy button next to the published hash, so the rest is a single right-click:

1. Copy the published checksum from the publisher's download page.
2. Right-click the downloaded file in File Explorer and pick Copy SHA-256 Checksum from the Copy Filenames sub-menu.

#The automatic MATCH / NO MATCH result

Here's where the workflow really pays off. When CopyFilenames computes a checksum, it checks the clipboard. If it finds something already on the clipboard that has the right shape for the algorithm you just ran — 64 hex characters for SHA-256, 32 for MD5, 128 for SHA-512, and so on — it treats that value as the published checksum and opens a comparison dialog with a clear MATCH or NO MATCH result:

Both values are shown in full, so if there's a mismatch you can see exactly where they diverge. Click OK to keep the new hash on the clipboard; Cancel leaves the clipboard untouched.

If the clipboard contains anything else — ordinary text, a file, an image, nothing at all — there's nothing to compare against, so CopyFilenames just copies the new hash to the clipboard and gets out of the way. The dialog only appears when it would actually be useful.

#Why this is the right shape of tool for the job

Verifying a downloaded checksum is a small task you might do dozens of times a year. The friction of opening a terminal, typing a path, remembering syntax, parsing multi-line output, and comparing two long hex strings by eye is small per occurrence but adds up — and more importantly, it's enough friction that most people skip the verification step entirely most of the time. Once the command is sitting on your right-click menu next to Copy and Properties, and the comparison happens in a dialog you don't have to set up, that friction disappears and verification becomes the default rather than the exception.

#Other checksum formats

SHA-256 is the most commonly published algorithm today and is on the menu by default. CopyFilenames also supports the other formats you'll occasionally encounter:

• MD5 — still common for legacy installers and many older download pages. Cryptographically broken for adversarial use, but perfectly fine for catching accidental corruption.
• SHA-1 — also legacy and also broken for adversarial use, but still published by some projects alongside other hashes.
• SHA-512 — the longer sibling of SHA-256, occasionally used where extra hash length is preferred.
• CRC32 — a fast non-cryptographic checksum common in archive formats (ZIP, RAR) and network protocols, often published for very large downloads where speed matters more than strength.
• xxHash64 — a very fast non-cryptographic hash used in some modern tooling and storage systems.

Each algorithm has its own command in the Command Gallery under the Hashes category. Open Copy Filenames → More Commands, click Browse Gallery..., filter for the algorithm you want, and add it to your menu in a click. The automatic clipboard comparison works the same way for all of them — match the published value's shape and you get a MATCH / NO MATCH dialog instead of a manual eyeball check.

#Frequently asked questions