How to Hash and Verify File Checksums in 2026 (MD5, SHA-256, and Free Tools)

TGH used to run a standalone MD5 hash tool on this site. It’s gone now, and honestly it was overdue: MD5 shouldn’t be your first choice for anything security-related in 2026, and a browser tab isn’t the most reliable way to check a file anyway. Windows already ships everything you need.

This covers generating and verifying file hashes with PowerShell’s Get-FileHash and the older certutil, when to use MD5 versus SHA-256, and which free third-party tools are worth installing if you’d rather point and click.

Why bother hashing a file at all

Two separate reasons, and they call for different algorithms. First, checking a download finished properly: ISOs, installers and large archives corrupt in transit more often than you’d think, and a hash mismatch catches that instantly. Second, verifying a file hasn’t been tampered with, which matters for anything you’re about to run with admin rights. For the first case any algorithm will do. For the second, use SHA-256 or better; MD5 collisions can be engineered deliberately, so it proves nothing about tampering, only accidental corruption.

PowerShell: Get-FileHash

This is the tool to reach for first. It’s already on every Windows 10/11 box and works identically on PowerShell 7 for macOS and Linux.

# Default algorithm is SHA256
Get-FileHash .\setup.exe

# Specify an algorithm explicitly
Get-FileHash .\image.iso -Algorithm SHA256

# Supported: MD5, SHA1, SHA256, SHA384, SHA512

To check the result against a hash a vendor published, don’t eyeball two long hex strings. Compare them directly:

$expected = "put-the-published-hash-here"
$actual = (Get-FileHash .\image.iso -Algorithm SHA256).Hash
$actual -eq $expected

Returns True or False. No squinting required.

certutil: the command line fallback

certutil predates PowerShell’s cmdlet and still turns up in older scripts and documentation. It works fine, but two things catch people out.

certutil -hashfile C:\Downloads\image.iso SHA256

Leave the algorithm off and it quietly defaults to SHA1, which you generally don’t want. And unlike Linux’s sha256sum -c, certutil has no built-in “verify against this value” mode, so pipe it through findstr to do the comparison in one line:

certutil -hashfile image.iso SHA256 | findstr /i "put-the-published-hash-here"

If the hash is found in the output, findstr prints the matching line and exits 0. No match, no output.

Free tools worth installing

Command-line tools are enough for a one-off check. For hashing whole folders, comparing sets of files, or working without a terminal, these are the free options actually worth having:

If you already run 7-Zip for archives, that last option means you don’t need to install anything new just to check a hash.

MD5 vs SHA-256: which one do you actually need

Use SHA-256 by default. It’s what Get-FileHash defaults to, it’s what most vendors publish alongside downloads now, and there’s no practical downside to computing it instead of MD5. Reach for MD5 only when something older specifically demands it, such as matching a checksum a legacy system or vendor still publishes in MD5 form. Treat that match as “the file probably didn’t get corrupted”, never as “this file is definitely authentic”.

Frequently asked questions

Is MD5 still safe to use for anything?

For catching accidental corruption, yes. For proving a file hasn’t been deliberately altered, no. MD5 collisions can be constructed on purpose, so a matching MD5 hash doesn’t rule out tampering.

Why does my hash not match what the vendor published?

Usually a partial or corrupted download: re-download and re-hash first. Otherwise check you’re comparing the same algorithm (a SHA1 value will never match a SHA256 hash of the same file) and that you copied the published hash in full, with no trailing whitespace or line break.

Can I hash an entire folder at once with PowerShell?

Yes, with Get-ChildItem piped into Get-FileHash:

Get-ChildItem -Path C:\Downloads -File | Get-FileHash -Algorithm SHA256 |
  Select-Object Path, Hash | Export-Csv hashes.csv -NoTypeInformation

That writes every file’s path and hash to a CSV in one go, which is handy for keeping a record before shipping a batch of files somewhere.