md5sum and sha256sum: Verifying File Integrity

md5sum and sha256sum: Verifying File Integrity
Reading time: About 10 min Difficulty: Beginner

What you'll be able to do

  • Compute a file's fingerprint with `sha256sum`
  • Verify recorded hashes against the current files with `-c`
  • Explain how hashing differs from encryption and encoding

Prerequisites (read these first)

What You'll Learn

  • Why checksums (hashes) exist and what problem they solve
  • How to compute a file's fingerprint with sha256sum
  • How to use -c to check whether a file is corrupted or swapped out
  • How to tell hashing, encryption, and encoding apart

Words used here (sorted out first)

  • Checksum / hash value / fingerprint: three names for nearly the same thing. This article says "fingerprint" when explaining the idea.
  • Hashing: producing a short value from the contents. You cannot get the file back from it. It answers "same or different?"
  • Encryption: making data readable only to whoever holds the key. Its goal is hiding contents, which is a different goal from hashing.
  • Encoding: only changing how data is written. Anyone reverses it without a key. base64 is this.

Hashing cannot be reversed. Encryption is reversible with the key. Encoding is reversible by anyone. Keep the three apart.

Quick Summary

  • Just want a fingerprint → sha256sum file
  • Check it matches the official value → sha256sum -c SHA256SUMS
  • For tamper protection use SHA-256. MD5 / SHA-1 are only for accidental corruption

Environment

  • OS: Ubuntu / typical Linux
  • md5sum / sha256sum ship with GNU coreutils and are preinstalled (no install needed)
  • Relatives include sha1sum / sha512sum / b2sum

1. What Is a Checksum?

Conclusion: A checksum is a "fingerprint" computed from a file's contents; changing even one bit changes it drastically.

Lina: Senpai, download pages sometimes show a long string like "SHA256: a1b2c3...". What is that?
Linny-senpai: That's a checksum, also called a hash value. It's like a fingerprint computed by reading the entire contents of a file. The same contents always produce the same value.
Lina: A fingerprint. So it's different for every file?
Linny-senpai: Close enough for now. Different contents almost always give a different fingerprint. I say "almost" for a reason — we'll get to it later.
Lina: Got it. I'll keep that in mind.
Linny-senpai: And if even a single bit changes, the fingerprint becomes a completely different value. That lets you instantly check whether a downloaded file is identical to the original.

What checksums let you do

  • Detect whether a downloaded file got corrupted in transit (corruption detection)
  • Confirm the contents match the source (detecting swaps / tampering)
  • Compare whether two files are byte-for-byte identical

A fingerprint cannot rebuild the contents

Hashing is a one-way street. You cannot restore the original file from the fingerprint. That is why it hides nothing. Use encryption when you need to hide something.

2. Computing a Fingerprint with sha256sum

Conclusion: sha256sum file computes the hash; output is "hash + two spaces + filename".

2-1. Basics: Fingerprint a Single File

$ sha256sum ubuntu.iso
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  ubuntu.iso
Lina: Whoa, a really long string came out, with the filename after it.
Linny-senpai: That's the SHA-256 fingerprint — 64 hexadecimal digits. If it matches, the contents are considered identical. Note there are two spaces in between; that matters later when verifying.

How to read the output

e3b0c4...b855  ubuntu.iso
└── hash ────┘└┘└ filename
              two spaces
  • The first space is a separator
  • The second character marks the input mode ( = text / * = binary)
  • On GNU systems both modes are identical (kept for historical compatibility)

2-2. md5sum Works the Same Way

$ md5sum ubuntu.iso
d41d8cd98f00b204e9800998ecf8427e  ubuntu.iso

md5sum computes MD5 and sha256sum computes SHA-256. That is the only difference; the usage is identical. The same goes for sha1sum / sha512sum.

3. Multiple Files and Saving a List

Conclusion: You can hash many files at once and save the list with > to reuse it later with -c.

3-1. Hash Several Files at Once

$ sha256sum *.iso
e3b0c4...b855  ubuntu.iso
9f86d0...0a08  debian.iso

3-2. Save the List to a File

$ sha256sum *.iso > SHA256SUMS

The name SHA256SUMS is a common convention on distribution sites. The file is just plain text with "hash + filename" on each line.

Where it lands, and the overwrite risk

Lina: What do I use this list for later?
Linny-senpai: With the next step's -c, you can verify in bulk whether the saved fingerprints still match the current files. It's handy for periodic checks that a backup hasn't rotted.

4. Verifying with -c (the Main Event)

Conclusion: sha256sum -c listfile compares recorded hashes against the current files: OK if they match, FAILED if not.

4-1. Check Against a List

$ sha256sum -c SHA256SUMS
ubuntu.iso: OK
debian.iso: OK

If a file's contents changed, you get:

ubuntu.iso: OK
debian.iso: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
Lina: If I see FAILED, does that mean the file is broken?
Linny-senpai: It means the saved fingerprint and the current contents differ. The cause is either a corrupted download or someone swapping the file. Either way, the right move is to not use that file.

4-2. Verify Against a Single Official Value

Sometimes a download page lists only one line, like "SHA256: official value". Turn that one line into a list file and verify against it.

# Write the official value and filename on one line (two spaces)
$ echo "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  ubuntu.iso" > check.txt
$ sha256sum -c check.txt
ubuntu.iso: OK

Don't retype the separator

Keep the gap between the "hash" and the "filename" exactly as sha256sum printed it: two spaces. With three or more, the extra blank becomes part of the filename and you get No such file or directory. When copying an official value, don't add stray whitespace.

4-3. Useful Options for Verifying

# Hide OK lines, show only failures
$ sha256sum -c --quiet SHA256SUMS

# Ignore files not in the list (when checking only some)
$ sha256sum -c --ignore-missing SHA256SUMS

# Print nothing, judge by exit code (for scripts)
$ sha256sum -c --status SHA256SUMS && echo "all match"

--status prints nothing. It decides solely by exit code (0 success / 1 failure). The exit code is the number that says whether the previous command succeeded; check it with echo $?. It's ideal for automated checks in shell scripts.

5. Corruption Detection Is Not Tamper Detection

Conclusion: Any hash can catch accidental corruption, but defending against malicious tampering requires SHA-256.

Lina: Aren't corruption detection and tamper detection the same thing?
Linny-senpai: Similar, but different. Corruption is a file breaking on its own from a transmission error or a bad disk. Tampering is an attacker deliberately swapping the contents while keeping the fingerprint the same. Resisting the latter requires a hash whose fingerprints cannot be collided on purpose.

Two goals

Goal What it prevents Usable hashes
Corruption check Accidental transit/disk corruption MD5 / SHA-1 are fine
Tamper check Deliberate swaps by an attacker SHA-256 or stronger

6. Why MD5 Is Discouraged Today

Conclusion: MD5 and SHA-1 allow practical collision attacks ("different contents, same fingerprint"), so they're discouraged for security.

Linny-senpai: Remember when I said "almost always" back in section 1? That "almost" is today's real topic.
Lina: I see MD5 a lot. Is it forbidden to use?
Linny-senpai: Not "forbidden" — it depends on the use case. MD5 and SHA-1 have practical collision attacks. An attacker can deliberately craft two files with different contents but the same fingerprint.
Lina: So even a matching fingerprint isn't reassuring.
Linny-senpai: Right. So don't use MD5 / SHA-1 for tamper protection. For merely catching accidental corruption in transit, they're still fine. When in doubt, choose SHA-256 and you won't go wrong.

7. Common Beginner Pitfalls

Conclusion: Misreading upper/lowercase, the number of spaces, and stray line endings are the typical causes of failed verification.

7-1. Comparing by Eye and Missing It

Lina: Senpai, I put the official value and my downloaded file's fingerprint side by side on screen. They matched, so I installed it.
Linny-senpai: Did you compare 64 digits by eye? One wrong character in the middle is easy to miss.
Lina: Oh no. I thought every character lined up, but honestly I skimmed the middle part.
Linny-senpai: Human eyes work that way. That's why you let -c do the comparison. It never misses a single character.
Lina: I see. Don't eyeball it — make the command decide.
# Bad: compare by eye (you'll miss something)
# Good: make a list and verify with -c
$ sha256sum -c SHA256SUMS

7-2. Extra Whitespace in the Separator

Put three or more spaces in the separator and you get this.

sha256sum: ' ubuntu.iso': No such file or directory
 ubuntu.iso: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read

FAILED open or read — rather than plain FAILED — does not mean the contents differ. It means the filename could not be read. A list made with sha256sum file > SHA256SUMS never takes this shape.

7-3. A Windows-Made List Won't Verify

Files from Windows use \r\n (CRLF) line endings. The trailing \r can cause trouble.

# Convert CRLF to LF before verifying
$ tr -d '\r' < SHA256SUMS.txt | sha256sum -c -

The trailing - means "read what comes through the pipe instead of a file." Think of it as putting - where the filename goes in sha256sum -c SHA256SUMS.

7-4. Hashes Match but the Files "Look Different"

If only the filename differs but the contents are identical, the hash matches. A hash looks only at contents — not the filename or timestamp.

8. Mini Exercises: Learn by Doing

Conclusion: Create your own file and walk through computing, saving, verifying, and detecting corruption to make it stick.

Lina: I've got the knowledge — I want to try it for real.
Linny-senpai: The best way is to make a test file and experiment. Here are three exercises.

Make an empty practice directory and work inside it. That way you never overwrite a file you already had.

# Prepare a practice directory and move into it
$ mkdir -p ~/checksum-practice && cd ~/checksum-practice

Exercise 1: Create a file with echo hello > a.txt and print its SHA-256 hash.

Show Hint 1 (Direction)

Pass the filename to the command that computes the fingerprint. No options needed.

Show Hint 2 (Command name)

Use sha256sum.

Show Answer 
$ echo hello > a.txt
$ sha256sum a.txt
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03  a.txt

The 64-digit fingerprint comes first, then the filename, with two spaces between.

Exercise 2: Save a.txt's hash list to SUMS and verify it to see OK.

Show Hint 1 (Direction)

Write the computed result into a file. Then have the command read that list back and check it.

Show Hint 2 (Command name)

The command is sha256sum. Save with the > redirection and verify with -c.

Show Answer 
$ sha256sum a.txt > SUMS
$ sha256sum -c SUMS
a.txt: OK

OK means the saved fingerprint and the current contents are the same.

Exercise 3: Modify a.txt, then verify again and confirm you get FAILED.

Show Hint 1 (Direction)

Append one line to the file. Then run the same verification as Exercise 2.

Show Hint 2 (Command name)

Append with >> (> would overwrite). The verification is the same command as Exercise 2.

Show Answer 
$ echo world >> a.txt
$ sha256sum -c SUMS
a.txt: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

When the contents change, the fingerprint changes and verification turns to FAILED.

9. Copy-Paste Templates

Conclusion: The standard forms for computing, saving a list, verifying, and matching a single official value are ready to copy.

Checksum Templates

# Fingerprint a single file
sha256sum file

# Hash several files at once
sha256sum *.iso

# Save a list (overwrites an existing name)
sha256sum *.iso > SHA256SUMS

# Verify against a saved list
sha256sum -c SHA256SUMS

# Show only failures
sha256sum -c --quiet SHA256SUMS

# For scripts (judge by exit code)
sha256sum -c --status SHA256SUMS && echo OK

# Verify against a single official value (trailing - reads the pipe)
echo "<official hash>  file.iso" | sha256sum -c -

# When you want a stronger hash
sha512sum file

What not to do

  • Use MD5 / SHA-1 for tamper protection
  • Compare 64 digits by eye (verify mechanically with -c)
  • Retype the separator by hand (copy sha256sum's own output instead)

Looking Back

Conclusion: A fingerprint cannot be reversed, and -c compares it, not your eyes.

Lina: Let me sum up. A hash is a fingerprint made from the contents, and you can't get the file back from it.
Linny-senpai: Right. Since it can't be reversed, it hides nothing. It answers "same or different."
Lina: And I shouldn't compare by eye. Let -c decide. That was exactly my mistake.
Linny-senpai: Well put. Add "SHA-256 against tampering" and that's everything worth taking home.

Three-Line Recap

Conclusion: Compute with sha256sum, verify with -c, and pick SHA-256 against tampering.

  1. sha256sum file computes a file's fingerprint. A hash cannot be reversed
  2. Don't compare by eye. Let sha256sum -c listfile make the call
  3. Use SHA-256 or stronger against tampering. Keep MD5 / SHA-1 for accidental corruption only

Next Reading

Share this article

Next steps

Next article → base64 Command: Encoding and Decoding Basics Practice with quiz → Verify your understanding Practice with lesson → Run commands in the terminal