Verify ISO File Integrity After Downloading

Verify ISO File Checksum After Download

Linux distributions, Windows ISOs, and bootable tools all publish SHA-256 checksums alongside their download links. Comparing the checksum of your downloaded file against the published value is the only way to confirm the file is complete, unmodified, and not tampered with in transit.

How SHA-256 checksums detect corruption and tampering

When you hash a file with SHA-256, the algorithm produces a 64-character hexadecimal fingerprint regardless of the file's size. Your browser processes the data in 512-bit blocks and outputs a fixed 256-bit digest at the end.¹ A 4 GB ISO and a 100-byte text file each produce a 64-character hex string, which makes SHA-256 practical as a verification target even for multi-gigabyte operating system images.

Two files that differ by even a single bit produce completely different SHA-256 hashes. This property, called the avalanche effect, means a partial download that dropped its final megabyte produces a hash that looks nothing like the expected value.¹ Corruption becomes immediately apparent. SHA-256 catches both accidental file corruption and deliberate modification with equal reliability, which is why every major OS distribution publishes these checksums alongside their downloads.

Hash algorithm generations and when to use each

You may encounter MD5 or SHA-1 on older distribution pages for some Linux releases. Both have known weaknesses: MD5 collision attacks were demonstrated in 2004,² and Google demonstrated a practical SHA-1 collision in 2017 in the SHAttered research.³ A collision means two different files produce the same hash value. For well-resourced attackers, this property reduces an algorithm's assurance against deliberate file substitution. When you verify an ISO, use SHA-256 whenever the publisher provides it. Fall back to MD5 or SHA-1 only when no stronger option appears on the publisher's page.

Finding the published checksum for major operating system ISOs

Ubuntu publishes SHA-256 checksums as a file named SHA256SUMS at releases.ubuntu.com, in the same directory path as the ISO download.⁴ Each line pairs a 64-character hash with a filename. Locate the line matching your downloaded ISO and copy the 64-character hex string that precedes it. Alongside the main checksum file, a SHA256SUMS.gpg file in the same directory lets you verify the checksum file itself against Ubuntu's release signing key, adding a layer of assurance beyond the hash alone.

Fedora provides a CHECKSUM file alongside each image on official download mirrors.⁵ Lines follow the format SHA256 (Fedora-Workstation-Live-x86_64-41-1.4.iso) = <hash> rather than the plain sha256sum format Ubuntu uses. The 64-character value appears after the equals sign. At cdimage.debian.org, Debian lists SHA256SUMS files in the same directory path as its ISO files, following the same plain format.⁶

Tails and Kali Linux checksum locations

Tails publishes SHA-256 hashes at tails.boum.org/install and recommends the Tails Verification browser extension, which automates the comparison step if you prefer a guided workflow, but you can verify a Tails ISO directly and skip the extension entirely.⁷ For Kali Linux, the official downloads page at kali.org/get-kali lists per-image SHA-256 checksums, accessible by expanding the checksum section beside each image variant.⁸ Both distributions treat hash verification as a documented and required step in their official installation instructions rather than an optional confirmation.

Command-line verification and diagnosing hash mismatches

On Linux, running sha256sum ubuntu-24.04-desktop-amd64.iso in a terminal prints the computed hash followed by the filename. The macOS equivalent is shasum -a 256 ubuntu-24.04-desktop-amd64.iso, which produces output in the same format. Both commands process your file in streaming fashion without loading it entirely into memory, making them practical for multi-gigabyte ISOs on any hardware.

For automated comparison on Linux, paste the expected hash from the publisher and run echo "EXPECTEDHASH filename.iso" | sha256sum -c in the directory containing your downloaded file. If the computed hash matches, the command prints "filename.iso: OK". A mismatch produces a "FAILED" message and exits with a non-zero status code. On Windows 10 and later, you can run Get-FileHash -Path .\yourfile.iso -Algorithm SHA256 in PowerShell to obtain the same digest natively.

When a mismatch might indicate a mirror problem

A hash mismatch after downloading an ISO almost always results from an incomplete or interrupted transfer rather than deliberate tampering. If the mismatch persists across multiple fresh downloads from the same mirror, try a different official mirror or network connection before concluding the file itself is the issue. Mirror servers occasionally serve outdated cached versions that match the expected file size but differ in content.

Pasting the wrong expected hash is the most common source of false mismatches during manual verification. Publisher download pages frequently list checksums for multiple editions on a single page. Copying the hash from the wrong row is an easy mistake. Before you download again, confirm the expected hash corresponds exactly to the filename and edition you downloaded.

When to use this

Use this immediately after downloading any bootable ISO: Ubuntu, Debian, Fedora, Tails, Windows, or any operating system image. Always verify before writing to a drive.

Examples

File: ubuntu-24.04-desktop-amd64.iso
Published SHA-256: 8762f7e74e4d64d72fceb5f70682e6b069932deedb4949c6975d0f0fe0a91be3

Computed SHA-256: 8762f7e74e4d64d72fceb5f70682e6b069932deedb4949c6975d0f0fe0a91be3
Result: MATCH. Download verified.