Checksums and code signing: two ways to check a download

One confirms the file arrived intact, the other tells you who published it. What each proves, and what neither can.

Download pages often show a long string of letters and digits next to a file, labelled something like SHA-256. Operating systems, meanwhile, show a publisher name when you run an installer. These are two different safety mechanisms. Each answers a narrow question, and knowing which question keeps you from trusting them for the wrong reasons.

What a checksum is

A checksum is a small block of data derived from a larger one, used to detect errors introduced during transmission or storage. For downloads, the checksum is normally a cryptographic hash, commonly from the SHA-2 family. The publisher runs the file through the hash function and posts the result. You run the same function on your copy. If the two strings match exactly, your file is the same as the one the publisher hashed. If a single character differs, the file is different: corrupted, incomplete or altered.

How to compare one

Every major desktop system includes a hashing tool, so nothing extra needs installing:

• Windows: certutil -hashfile filename SHA256 in a command prompt, or Get-FileHash filename in PowerShell.
• macOS: shasum -a 256 filename in Terminal.
• Linux: sha256sum filename.

Compare the output with the published value. Checking the first and last few characters by eye catches accidents; pasting both strings into a text editor, one above the other, is more thorough.

The limit of a checksum

A matching hash proves the file equals whatever was hashed. It does not prove that the page displaying the hash is honest. If you downloaded from a fake site, the fake site can simply publish the hash of its fake file. A checksum is therefore strongest when the hash comes from a different place than the file: for example, the file from a mirror and the hash from the developer's own site.

What code signing is

Code signing is the process of digitally signing executables and scripts to confirm the software author and to guarantee that the code has not been altered or corrupted since it was signed. When you open a signed installer, the operating system checks the signature and shows the publisher's name. An unsigned file, or one whose signature fails, produces a warning.

How to read the prompt

• Check that the publisher name is the one you expect, spelled correctly.
• Take an "unknown publisher" warning seriously for a program from a large company, which would normally sign its releases.
• Small and volunteer projects sometimes do not sign, because certificates cost money. For those, a checksum from the project's own page matters more.

The limit of a signature

A valid signature identifies who signed the file. It is not a verdict on what the program does. Unwanted software can be properly signed by a real company, and signing keys have been stolen in the past. Treat the signature as an answer to "who published this?", not "is this safe?".

Using both together

The two checks complement each other. The hash ties your copy to the publisher's copy; the signature ties the file to a named publisher. Add a scan with antivirus software, a program designed to prevent, detect and remove malware, and you have three independent looks at one file, each taking under a minute.

None of these checks is proof of safety. They reduce the chance of installing a tampered or mislabelled file; keeping backups limits the damage if something still goes wrong.

written by Bram Oosterveld / last revised 2026-11-12