Check a SHA-256 Fingerprint on a Computer

Before you type anything

You need two things: the file, and the fingerprint its publisher printed. Keep the file in a folder you can find, such as Downloads. The commands below only read the file. They do not change it and need no special rights.

Open a terminal, which is a window where you type commands:

• Windows: press the Start button, type cmd for Command Prompt or powershell for PowerShell, then press Enter.
• Mac: press Command and Space, type Terminal, then press Enter.
• Linux: open Terminal from your apps menu.

These windows start in your personal folder, so cd Downloads takes you into Downloads. In the examples, file.apk stands for your file’s name. If the name has spaces, put it in double quotes.

The four commands

The long value in each example is made up. It counts from 0 to f four times, so you cannot mistake it for the fingerprint of a real file. Yours will look different.

Windows: Command Prompt

C:\Users\you\Downloads> certutil -hashfile file.apk SHA256
SHA256 hash of file.apk:
0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
CertUtil: -hashfile command completed successfully.

The long line is the fingerprint. Some older versions of Windows print it as pairs of characters with a space between each pair. The spaces are not part of the value.

Windows: PowerShell

PS C:\Users\you\Downloads> Get-FileHash file.apk -Algorithm SHA256

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF       C:\Users\you\Downloads\file.apk

PowerShell adds the algorithm and the path, and prints the fingerprint in capital letters. It is the same value. Leave out -Algorithm SHA256 and PowerShell still uses SHA-256, but the longer form leaves no doubt.

macOS

you@mac Downloads % shasum -a 256 file.apk
0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef  file.apk

The -a 256 asks for SHA-256. The fingerprint comes first, then two spaces and the file name.

Linux

you@pc:~/Downloads$ sha256sum file.apk
0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef  file.apk

The command name already says SHA-256, so there is nothing to choose. Most Linux systems have it built in, and the output has the same shape as on a Mac.

Comparing two long values

A 64-character value is easy to misread. These habits help.

1. Paste, do not retype. Copy the publisher’s value and the command’s value into a plain-text editor, one above the other. Use an editor that gives every character the same width, such as Notepad, so the two lines line up and any difference stands out.
2. Ignore what does not matter. Capital against small letters (PowerShell prints capitals, macOS and Linux print small letters), spaces inside the value, the file name after it, and a label such as “SHA256”.
3. Check the length. A SHA-256 value is exactly 64 characters, made only of 0 to 9 and a to f. A letter beyond f, or a different length, means a copy error or a different kind of value. MD5 has 32 characters and SHA-1 has 40.
4. Compare every character, not just the start and the end. A change in the middle is the easiest to miss.
5. Or let the tool compare. The file fingerprint checker takes the file and the publisher’s value and does the comparing, so you can skip the command.

If the values differ

Do not install the file. First rule out three simple causes:

• The publisher’s value belongs to a different version of the file. A new version has a new fingerprint.
• It belongs to a ZIP folder that holds the app, not to the app file inside.
• The download did not finish or was damaged. Download it again once from the same place.

If the values still differ, you have a different file from the one described. Delete it. Do not search for a “fixed” copy elsewhere. Using the website without an app file is the safer route.

What a command cannot tell you

A match shows that your file is the one the fingerprint was printed for. It does not show that the publisher is trustworthy, and a command cannot see what an app will do once it runs. Before you install anything, read permissions to refuse. On a phone, the Android page does the same check without a terminal.