Verify a download with SHA-256
How to verify a download with SHA-256
One command, already on your PC, that proves a downloaded file is byte for byte the one the publisher built. It works for any download, not only ours.
Find the hash the publisher gives
A SHA-256 is 64 characters of hexadecimal, published on the same page as the download. If a publisher does not print one anywhere, there is nothing to check against and this procedure cannot help you.
Open Command Prompt where the file is
In File Explorer, open the folder holding the download, click the address bar, type cmd and press Enter. Command Prompt opens already pointed at that folder.
Run certutil
Type: certutil -hashfile FILENAME SHA256 - replacing FILENAME with the actual name of the file. certutil is part of Windows, so there is nothing to install. It prints one long line of hexadecimal.
Compare the two strings
They must match exactly. Case does not matter and the spaces certutil inserts do not either, but every character does. Checking the first and last six characters catches essentially every real mismatch.
Delete it if they differ
A mismatch means the file is not what the publisher built. It might be a truncated download, a mirror serving something older, or something worse. Delete it and download again from the publisher's own site - never from a mirror or a link somebody sent you.
What this actually proves
A hash is a fingerprint of a file's contents. Change one byte anywhere and the hash changes completely, so a matching hash means you have the exact file the publisher hashed - not a resembling one, not an older build, not one something added to on the way.
What it does not prove is that the publisher is trustworthy. It proves you have their file. Those are different questions, and the second one is answered by who they are and what they publish about themselves.
Hash versus code signature
A code signature is a certificate saying who built a file, checked by Windows before it runs and shown in the UAC prompt. It is convenient - the check happens without you - and it costs a few hundred dollars a year, which small publishers frequently do not spend.
A published hash covers the same ground with more work and less ceremony: the signature tells you a name, the hash tells you the whole file. Neither tells you the program is good. Both tell you it is unaltered.
Trying it on EasyUnZip
SHA-256 of the EasyUnZip 0.1.1 installer:
a21cbe85927f9a04dd5789bf4cfee96c9f132994ef9f7b12481c399501e3d696
certutil -hashfile EasyUnZip-Setup-0.1.1.exe SHA256
Our installer is not code-signed, so this is the check that stands in for one - the security page explains why we made that trade. The hash changes with every release, so use the one printed beside the file you downloaded rather than one you saved earlier.
PowerShell, if you prefer it
Get-FileHash .\EasyUnZip-Setup-0.1.1.exe -Algorithm SHA256
Same answer, different formatting - PowerShell prints it as one unbroken string, which is easier to compare by eye than certutil's spaced output.