Check File Integrity in Windows with SHA-256

To check whether a file in Windows matches a known-good copy, calculate its SHA-256 hash and compare the result with the value published by the file’s publisher. Windows includes PowerShell’s Get-FileHash cmdlet and the certutil command, so you do not need a third-party checksum utility. A hash by itself is only a fingerprint; it can confirm a match only when you have a trustworthy reference value.

What a file hash can tell you

A hash is a fixed-length value calculated from a file’s contents. The filename and extension do not determine the hash, but changing the contents usually changes it. If two files have the same SHA-256 hash, they have the same contents for practical file-checking purposes. A mismatch means the bytes differ; it does not reveal whether the cause was an incomplete download, a different release, a damaged drive, or an intentional change.

For a download, the reference should come from the software publisher’s official page and match the exact file, version, and architecture you downloaded. A checksum copied from an untrusted mirror does not establish that a file is genuine. If the publisher does not publish a hash, calculating one locally cannot prove authenticity.

Check a downloaded file with PowerShell

1. Find the publisher’s SHA-256 value. Open the official download page and confirm that its checksum belongs to the same release and file name. Copy the full SHA-256 value for comparison.

2. Open PowerShell or Windows Terminal. Search for PowerShell in Start, or open Terminal from the Start menu. A standard user session is enough to hash an ordinary file; administrator access is not required.

Get-FileHash -LiteralPath "C:\Users\YourName\Downloads\installer.exe" -Algorithm SHA256

Replace the sample path with the file’s full path, keeping the quotation marks if the path contains spaces. The command prints the algorithm, hash, and path. PowerShell uses SHA-256 by default, but naming the algorithm makes the comparison explicit. Microsoft documents the command and its supported parameters in the Get-FileHash reference.

3. Compare the complete hash. Check that the output says SHA256, then compare every character in the Hash value with the publisher’s checksum. Letter case does not matter, but omitted or extra characters do. You can also ask PowerShell to return a simple result:

$expected = "PASTE_THE_PUBLISHED_SHA256"
$actual = (Get-FileHash -LiteralPath "C:\Users\YourName\Downloads\installer.exe" -Algorithm SHA256).Hash
$actual -eq $expected

A result of True means the locally calculated value matches the value you entered. False means they differ; recheck that you copied the right checksum and selected the matching download before drawing conclusions.

4. Respond to a mismatch carefully. Do not open or install the file while the mismatch is unexplained. Delete or quarantine that copy, download it again from the publisher’s official site, and repeat the check. Confirm you are not comparing a newer version, a different language, or a different processor build against an older checksum.

Use Command Prompt with CertUtil

If you prefer Command Prompt, run this built-in command in Windows Terminal or a Command Prompt window:

certutil -hashfile "C:\Users\YourName\Downloads\installer.exe" SHA256

Read the hash printed between the command output lines and compare it with the same publisher value. The official CertUtil documentation describes -hashfile as generating and displaying a cryptographic hash over a file.

What about MD5, SHA-1, and SFV files?

Older download pages may provide MD5 or SHA-1 values, and an .sfv file contains CRC-32 checksums for a set of files. These formats can still help detect some accidental transfer errors when you compare them with a trusted original manifest. They are not a safe way to establish that a download is authentic. Microsoft notes that MD5 and SHA-1 are no longer considered secure against attack; use SHA-256 when the publisher offers it. If a legacy source provides only an MD5 value, treat it as a limited change check rather than proof of trust.

Checking Windows system files is a different task

Get-FileHash checks a file against a reference you provide; it does not know what a Windows system file should contain. For protected Windows files, use System File Checker from an elevated terminal: sfc /verifyonly scans without repairing, while sfc /scannow scans and attempts repairs. Microsoft lists these options in its SFC command reference. Use the hash method for downloads, archives, backups, and other files where you have a trusted checksum.