Verify a SHA-256 checksum on Windows
A SHA-256 checksum lets you confirm a downloaded file arrived intact and matches the exact file that was published. Windows can do this with tools it already has — no extra software. Here’s how, in PowerShell or Command Prompt.
What this solves
When you download a program, you want to be sure the file wasn’t corrupted in transit or swapped for a different one. Publishers list a SHA-256 hash — a long string of hex characters — for each file. If the hash you calculate locally matches the published one, you have the exact file that was published.
What you need
- The downloaded file.
- The published SHA-256 hash, from a source you trust.
- Windows PowerShell or Command Prompt — both are built in.
Step by step
- Note the published hashCopy the SHA-256 value the publisher lists for the exact file you downloaded. Make sure it’s the SHA-256 value, not MD5 or SHA-1.
- Calculate the hash in PowerShellOpen PowerShell, then run this against your file’s path:
Get-FileHash -Algorithm SHA256 "C:\Users\You\Downloads\your-file.exe"
TheHashvalue it prints is your file’s SHA-256. - Or calculate it in Command PromptIf you prefer Command Prompt, use the built-in
certutil:certutil -hashfile "C:\Users\You\Downloads\your-file.exe" SHA256
- Compare the two valuesCompare the calculated hash with the published one. The comparison is not case-sensitive, but every other character must match exactly. It helps to paste both into a text editor, one above the other.
What you should see
If the two hashes are identical, the file is intact and matches what was published — you can proceed. Treat a match as your green light to continue.
Common errors
- “No such file” or a blank result: the path is wrong. Put the full path in quotes, or drag the file into the window to insert its path.
- Values look completely different: check you calculated SHA-256 (not MD5/SHA-1) and compared against the SHA-256 the publisher listed.
- A genuine mismatch: if the hashes truly differ, do not run the file. Delete it and download again from the official source, then re-check.
Limitations to keep in mind
A checksum proves the file matches the published hash and wasn’t corrupted. It does not, on its own, prove who published it — that assurance comes from code signing and certificates. So only compare against a hash you obtained from a source you trust, over a connection you trust.
Related YTS Control capability
Use this whenever you download YTS Control or its prerequisites — for example before running the Npcap installer. You’ll find release files via the downloads section on the home page.