Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To know whether an installer or disk image is genuine, verify it in two layers: calculate the file’s checksum and compare it with a value obtained from the publisher, then validate a digital signature when one is provided. A matching SHA-256 proves that your bytes are identical to the published bytes; a valid signature also connects those bytes to a publisher key or certificate. Start with the project’s official release channel, record the exact filename, version, architecture and algorithm, and stop if any hash, signature, signer or certificate check fails.
What do checksums and digital signatures prove?
A checksum (also called a hash or digest) is a fixed-length value calculated from every byte in a file. Changing even one byte produces a different digest, so comparing your locally calculated value with the publisher’s value detects corruption, an incomplete transfer or a modified file.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
A checksum does not identify who supplied the expected value. If an attacker can replace both the download and an unsigned hash displayed beside it, both values can match while the download remains malicious. The Apache Software Foundation therefore notes that hashes detect changes but do not, by themselves, guarantee authenticity.
A digital signature adds a cryptographic identity check. The publisher signs a digest with a private key; your verification tool uses the corresponding public key or certificate to check that the signature is valid and that the signed content has not changed. Debian describes signed checksum files as confirming both that an image was not tampered with and that it was created and released by Debian.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Check | What a pass establishes | What it does not establish |
|---|---|---|
| Checksum comparison | Your file’s bytes equal the bytes represented by the published digest. | That the digest came from the real publisher, unless its delivery channel is trusted. |
| Detached or signed checksum | The digest was signed by an accepted release key, linking the expected bytes to a project identity. | That you downloaded the intended file if you verified a different filename, version or architecture. |
| Operating-system signature | The platform recognizes the signer or certificate and reports that the file remains unchanged. | That an unofficial source is safe merely because it uses a valid certificate. |
| HTTPS/TLS | The connection was protected in transit between your device and the server. | That the release server, mirror or file itself was not compromised. |
What should I record before downloading?
Use the publisher’s official release page, repository, or documented mirror list rather than a search-result mirror or a third-party repackaging site. Before saving the file, write down the exact release details shown by the project:
- Filename, including extension and architecture such as x86_64, arm64 or 32-bit.
- Version, build number and release channel (stable, beta or nightly).
- Operating system and package type: installer, archive, package or disk image.
- Hash algorithm and expected value, preferably SHA-256 or SHA-512.
- Signature filename, signing-key fingerprint, certificate details and the project’s instructions for obtaining trusted keys.
Do not silently substitute a similarly named file. A checksum is tied to the complete byte sequence, so a different language pack, rebuild or processor architecture must have its own published value.
Recommended Free Tools
How do I verify a Windows download?
Windows provides a built-in checksum command, and signed executables expose their Authenticode information in the file properties. Perform both checks when the publisher supplies a digest and a signature.
Calculate a SHA-256 checksum with certUtil
- Open File Explorer and confirm the downloaded file’s complete name and location.
- Open Command Prompt.
- Run the command below, replacing the path with the actual file:
certUtil -hashfile C:pathtofile.exe SHA256certUtil prints the digest in hexadecimal. Compare every character with the publisher’s SHA-256 value; ignore spaces that Windows inserts for readability, but do not ignore a differing character.
Apache’s Windows guidance also documents the equivalent SHA-512 form:
certUtil -hashfile C:pathtofile.exe SHA512Use the algorithm named by the publisher. Calculating SHA-256 when the release page publishes SHA-512 is not a valid comparison unless the project publishes both values.
Inspect an Authenticode signature
- Right-click the executable or installer and choose Properties.
- Open the Digital Signatures tab.
- Select the listed signature and choose Details.
- Confirm that Windows reports the signature as valid, inspect the signer name and certificate path, and check that the certificate authority is trusted.
Microsoft’s Authenticode checks cover signature validity, a trusted signer, a trusted certificate authority and unchanged file content. A missing signature, an invalid signature, an unknown signer or a broken certificate chain is a stop condition, not a prompt to continue.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
How do I verify a macOS download?
For a digest, use the system’s shasum utility. For signed packages and applications, inspect the signing certificate and its SHA-256 fingerprint before installation.
Calculate the digest
shasum -a 256 ~/Downloads/file.pkgCompare the resulting value with the publisher’s SHA-256 entry. If the downloaded item is an archive or disk image, substitute its exact path and extension; the command works on any file.
Check a package certificate
Use the package’s certificate or system assessment interface to view the signer and certificate details. Apple’s package-verification guidance calls for matching the certificate’s SHA-256 fingerprint with the fingerprint published by the project. If no certificate icon or signing information is present, the package is unsigned and should not be installed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A certificate that is valid for an unrelated developer does not make a package trustworthy. Confirm that the identity matches the software publisher you intended to download and that the package came from the publisher’s official channel.
How do I verify a Linux download?
Linux distributions commonly publish a checksum file and, for stronger assurance, a detached OpenPGP signature over that checksum file or over the release itself. Calculate the digest first, then verify the signed file that supplied the expected value.
Calculate SHA-256 or SHA-512
sha256sum ./downloaded-file
sha512sum ./downloaded-fileApache’s Linux instructions use these commands to establish byte-for-byte equality with a published release value. A line ending in the filename and a matching digest indicates a pass; a different digest means the file is not the published byte sequence.
Verify a detached OpenPGP signature
When a project supplies a pair such as file and file.sig or file.asc, run:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
gpg --verify file.sig fileGnuPG reports a good signature when the signed bytes match and the signature comes from a key in your keyring. Read the signer identity and fingerprint in the output; a “good” cryptographic signature from a key you have not authenticated is not enough. Obtain the fingerprint through the project’s official key-distribution instructions and compare it character-for-character.
GnuPG warns that a newly downloaded GnuPG binary should not be trusted to verify its own source. Use an already trusted installation or a verification environment established before the download.
How do I verify an Ubuntu installation image?
Ubuntu’s documented process signs the checksum list, not just the image. The signature on the checksum list must validate before any digest listed in that file is trusted.
- Follow Ubuntu’s instructions to obtain the Ubuntu image-signing public key and save it as
ubuntu.gpg. Check the published fingerprint through the project’s official documentation. - Download the image,
SHA256SUMSandSHA256SUMS.gpgfrom the same release channel. - Verify the signed checksum file:
gpgv --keyring ./ubuntu.gpg ./SHA256SUMS.gpg ./SHA256SUMS- After the signature succeeds, check the image against the signed list:
sha256sum -c --ignore-missing ./SHA256SUMSThe second command may report several entries as missing because the list covers multiple images; --ignore-missing checks only the files you have. Ubuntu’s security documentation says installation images should be manually verified even when downloaded over TLS.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat is the correct order for a complete verification?
Follow this sequence whenever a project provides both a checksum and a signature:
- Use an official channel. Avoid an unlisted mirror, repackaged installer or file supplied by an unknown forum account.
- Match release metadata. Confirm version, platform, architecture, filename and package type before running a command.
- Acquire trusted key material. Follow the project’s documented process for a public key or certificate and verify its fingerprint independently of the file being checked.
- Verify the signature. Check a signed checksum list or detached signature before trusting its digest.
- Calculate the local hash. Use the exact algorithm named by the project and the exact file you intend to install.
- Compare character-for-character. A near match is still a failure.
- Inspect platform trust. On Windows, review Authenticode details; on macOS, review the package certificate and fingerprint.
- Install only after every applicable check passes. Keep the verified file and its release metadata together if you need to audit or reinstall later.
Which hash algorithm should I use?
Use the algorithm specified by the publisher, with SHA-256 or SHA-512 preferred for new releases. Apache marks MD5 and SHA-1 as deprecated in its release guidance because they no longer provide an appropriate collision-resistance margin for release verification.
Do not compare values produced by different algorithms. An MD5 value cannot validate a SHA-256 comparison, and recalculating with a stronger algorithm does not prove anything unless the publisher supplied the corresponding expected value.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
What should I do when verification fails?
Do not install or execute the file after a failed check. First determine whether the failure is a simple selection error; if it is not, obtain a fresh copy from the official project channel.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If the checksum differs
- Check that the command points to the intended file, not an older download with a similar name.
- Confirm the release version, operating system, architecture and algorithm.
- Rule out a partial or interrupted download by downloading the file again.
- Make sure you compared against the checksum for the same package type; an archive and an installer will have different values.
- If a fresh official download still differs, report the mismatch to the project and wait for clarification.
If the signature is bad or the signer is unexpected
- Do not bypass a “BAD signature,” unknown-signer or untrusted-certificate warning.
- Re-check the public-key fingerprint using the project’s official documentation, not a fingerprint copied from the unverified download.
- Look for a documented key rotation, expiration or replacement and follow the project’s new-key procedure.
- Verify that you used the correct signature file and that the signature and payload belong to the same release.
Debian and GnuPG treat signature and file mismatches as reasons to investigate before use. A warning that disappears after importing an arbitrary key is not a successful verification.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do signatures, certificates and TLS differ?
TLS protects the network connection while you download. It can prevent an ordinary eavesdropper from changing bytes in transit, but it does not replace a release-level check if a server, mirror or distribution channel has been compromised.
A release signature is attached to a specific file or checksum list and can be checked later, including after the file has been copied to removable media. A platform certificate provides an operating system with a signer identity and trust chain. A valid certificate helps establish who signed the file, but it does not make an unofficial download trustworthy or prove that the publisher intended that particular distribution channel.
| Situation | Minimum useful action | Preferred action |
|---|---|---|
| Official page publishes only a SHA-256 value | Calculate SHA-256 and compare exactly. | Confirm the page itself is the project’s official channel and use a separate trusted channel for the expected value when available. |
| Signed checksum file is available | Verify the signature, then check the file’s hash. | Authenticate the signing-key fingerprint before accepting the signature. |
| Windows executable has Authenticode | Inspect Properties → Digital Signatures. | Also compare the publisher’s SHA-256 value if one is published. |
| macOS package has a certificate | Inspect the certificate and SHA-256 fingerprint. | Also compare the package digest with the project’s release value. |
| No hash or signature is published | Do not treat HTTPS or a download counter as proof of authenticity. | Find a release channel that publishes verifiable metadata or ask the project to provide it. |
How should projects handle signing keys and key changes?
Verification depends on the trust path for the key, not only on the cryptographic mathematics. A project should publish the key fingerprint in documentation or another established channel, explain where signatures are attached, and document rotations, revocations and expirations.
When a key changes, do not accept a new key merely because a downloaded signature says it is valid. Compare the replacement fingerprint with the project’s announced transition information, then update the trusted keyring and retain the old key only as long as the project’s instructions require.
What are the most common verification mistakes?
- Checking the wrong file: a command can succeed while pointing at an older or differently named download.
- Using the wrong algorithm: SHA-256, SHA-512, SHA-1 and MD5 values are not interchangeable.
- Trusting an unsigned hash from the same compromised page: matching values prove equality with that page’s value, not publisher identity.
- Ignoring architecture: x86_64, arm64 and 32-bit releases normally have different digests.
- Importing an arbitrary signing key: a valid signature from an unauthenticated key does not establish the expected publisher.
- Continuing after a warning: “BAD signature,” revoked key, unknown signer or unsigned package is a stop condition.
- Assuming HTTPS is sufficient: transport encryption does not replace release verification.
- Letting a new binary verify itself: use a previously trusted checksum or GnuPG installation for the initial check.
How can I verify a file before installing it offline?
Download the payload, checksum or signature, and trusted key material on a connected system, then transfer them to the offline verification machine using controlled removable media. Run the same checksum and signature commands there, using a verification tool already installed and trusted on that machine.
Keep the original release metadata with the verified file and record the result, algorithm, key fingerprint and date. This creates an audit trail without relying on the installation environment’s network connection.
What should a verification result look like?
A successful result is specific: the filename and release match, the signed metadata verifies with an authenticated key or certificate, and the locally calculated digest exactly matches the signed or officially published value. Anything less should be treated as unresolved rather than as an implicit pass.
Once all checks pass, install the file through the normal operating-system process. If any check fails, preserve the evidence—the filename, command output and release details—and obtain guidance from the project instead of distributing or executing the unverified copy.
Frequently Asked Questions
Can I trust a checksum copied from a forum post or chat message?
Only if you can independently establish that the value came from the publisher and applies to the same release and architecture. Prefer a signed checksum file or a value published through the project’s documented official channels; an unsigned repost can be altered without detection.
Does renaming a verified installer invalidate its checksum?
No. Renaming changes the filename, not the file bytes, so the digest remains the same. You should still preserve the original release name in your notes so you do not compare the renamed file with the wrong build or package.
Can malware survive a valid digital signature?
A valid signature proves control of the signing key and that the signed bytes were not altered after signing; it does not prove that the publisher’s build process or signing key was never compromised. Use the official release channel, confirm the signer identity and consider project security advisories for high-risk software.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Why does a checksum command report a different line ending or capitalization?
Hexadecimal letters may appear in upper- or lowercase without changing the value, but every hexadecimal digit must otherwise match. Extra spaces inserted for display are harmless; a missing digit, extra digit or different filename indicates a failed comparison.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
