Windows guide
How to check the SHA-256 hash of a download
Make sure an installer you downloaded is exactly the one the developer published — one command in PowerShell.
By the Softvault team ·
Many developers publish a checksum (usually SHA-256) next to their downloads. If your file's checksum matches theirs, it wasn't corrupted or tampered with. It takes one command.
In PowerShell
Open the folder with the file, click the address bar, type powershell and press Enter, then run:
Get-FileHash .\setup.exe -Algorithm SHA256Replace setup.exe with your file's name. In Command Prompt you can use certutil instead:
certutil -hashfile setup.exe SHA256Compare the result
Compare the printed string with the one on the developer's website. Upper or lower case doesn't matter; every other character must match. If they differ, delete the file and download it again from the official page.
Check the digital signature too
Right-click an .exe or .msi, choose Properties and open Digital Signatures. The signer should be the developer or company you expect. A signature from an unexpected name is a red flag; many small open-source tools are simply unsigned, which isn't automatically dangerous.