How to check a file’s SHA256 hash on Windows
A SHA256 hash is a fingerprint of a file. If the hash of your download equals the one published for it, you have exactly the file that was published, without changes or download errors.
Get the hash with PowerShell
Get-FileHash is built into Windows. Run it in the folder that holds the download; SHA256 is its default algorithm.
Get-FileHash .\vlc-3.0.21-win64.exe -Algorithm SHA256Or with the command prompt
certutil, available on every Windows version, prints the same value in lower case (older Windows versions put spaces between the bytes).
certutil -hashfile vlc-3.0.21-win64.exe SHA256Compare automatically
Paste the published hash between the quotes. The comparison ignores upper and lower case and prints True when the file matches.
(Get-FileHash .\vlc-3.0.21-win64.exe).Hash -eq "PUBLISHED-SHA256-HASH"What a mismatch means
The file is not the one that was published: the download was cut off, a proxy changed it, or the publisher replaced the file at the same address. Do not run it. Download it again from the official address; if the hash still differs, the publisher has probably changed the file, and the manifest will be updated.
Check the digital signature too
The hash proves that the file is unchanged; the signature tells you who published it. In PowerShell, Get-AuthenticodeSignature shows the signer and whether the signature is valid. In Explorer: Properties → Digital Signatures.
Get-AuthenticodeSignature .\vlc-3.0.21-win64.exe | Format-List Status, SignerCertificateFrequently asked questions
Does a matching hash mean the program is free of malware?
No. It means the file is the one listed in the package data. To check the content, scan the file or look up its hash on VirusTotal; ExeAtlas links that lookup for every installer.
Is SHA256 better than MD5 or SHA1?
Yes. MD5 and SHA1 can be forged on purpose; SHA256 cannot with today’s means, which is why winget uses it.