When you download files online, you are provided with a file hash to check the integrity of the file. Rightly or wrongly, most people ignore file hash verification, the assumption being that if the file is malicious, the site owner would realize and take it down. That or their antivirus would stomp out the suspicious download before it executes.
Wondering how you check the file hash? Here are seven tools you can use to verify the file you're downloading is safe.
1. Check File Hash Using PowerShell
Handily, Windows comes with an integrated file hash checker. It is a PowerShell function, and it is easy to use. The PowerShell file hash check function supports SHA1, SHA256, SHA384, SHA512, MACTripleDES, MD5, and RIPEMD160.
Here's how you check a file hash using PowerShell.
First, press the Windows Key, then type PowerShell. Select the best match to open PowerShell. The basic file hash check command is:
get-filehash FILEPATH
For example, "get-filehash c:\recovery.txt" gives you the following output:
The default hash output is in SHA256. If you want a different hash value for the file, use the following command:
get-filehash -Algorithm [HASH TYPE] FILEPATH
For example, "get-filehash -Algorithm SHA384 c:\recovery.txt" now gives the following output:
The time it takes to generate a hash depends on the size of the file and the algorithm you use.
2. Hash Generator
SecurityExploded's Hash Generator is an easy-to-use hash generation tool that accommodates a wide range of hashing algorithms. The free hash tool can generate hashes for MD5, SHAxxx, Base64, LM, NTLM, CRC32, ROT13, RIPEMD, ALDER32, HAVAL, and more.
It is one of the most comprehensive hashing tools around.
What's great about Hash Generator is that you can use it for any number of situations. Want a hash for a specific piece of text? Just copy the text into Hash Generator. Want to create a file hash quickly in File Explorer? Use the Hash Generator option in your right-click context menu.
You can also drag and drop a file into Hash Generator, and it'll start working immediately.
Download: Hash Generator for Windows (Free)
3. HashMyFiles
Ever-present software developers Nirsoft's HashMyFiles is a handy portable hash generator. Setting it aside from most tools, HashMyFiles allows for batch hash generation. You can load up HashMyFiles with a list of files you want the hash for, set it to work, and receive hashes for the entire list.
HashMyFiles will display hashes for MD5, SHAxxx, and CRC32. Like Hash Generator, you can add a HashMyFiles entry to your right-click context menu. However, HashMyFiles allows you to add an entire folder for hashing via the context menu, rather than the single file option of Hash Generator.
Download: HashMyFiles for Windows (32-bit) | Windows (64-bit) (Both Free)
4. OpenHashTab
OpenHashTab is a different take on file hash generation. Rather than using a separate interface to generate your file hashes, OpenHashTab adds a tab to your right-click context menu. So, instead of dragging and dropping a file into a program, you right-click the file and select Hashes.
OpenHashTab generates hashes for MD5, SHA1, SHA-256, and SHA-512 by default. However, the OpenHashTab options allow you to add hashes for 22 additional hashes, including the SHA family, RIPEMD, BLAKE, and WHIRLPOOL.
You can add more hashes to the Hashes menu by opening Hashes and selecting Settings (the cog icon). Check the hashes you want to add and press OK.
Download: OpenHashTab for Windows (Free)
5. QuickHash
QuickHash is an open-source hash generator for Windows, macOS, and Linux. It is also one of the most fully-featured hash generation and checking options on this list.
Although the number of hashes you can use is small—just MD5, SHA1, SHA256, SHA512, and xxHash64—Quick Hash has a heap of additional functions.
QuickHash can hash an entire folder, compare two individual files, compare entire directories, or an entire disk. Of course, the latter takes a substantial amount of time due to the size, but the option is nice to see. You can also work through a text document line by line, hashing each one as you go.
Download: QuickHash for Windows, macOS, or Linux (Debian) (Free)
6. MultiHasher
MultiHasher presents users with a wide array of hash generation and checking tools in a single package. Like many of the best hash generation and checking programs, MultiHasher has several hashing options. You can drag and drop a single file or an entire folder for hashing or generate a hash for a text string.
MultiHasher outputs hashes in MD5, SHA1, SHA256, SHA384, SHA512, or RIPEMD-160.
MultiHasher also has a feature I haven't seen in any other file hash generator and checker: it integrates the malicious file checking database of VirusTotal. You can check the hash of the downloaded file matches the download source, as well as inform VirusTotal of anything untoward or malicious at the same time.
To use the VirusTotal query, select a file hash from your list, then head to Tools > Query VirusTotal. However, you need a VirusTotal API key, which you can get by signing up for a free VirusTotal account.
Download: MultiHasher for Windows (Free)
Download: MultiHasher for Windows (Free, alternative download link)
7. 7-Zip
If you have 7-Zip installed, you can use this for a quick hash check.
Head to the file you want to check, then right-click and head to 7-Zip > CRC SHA > *, after which the 7-Zip Checksum will appear with hashes for CRC32, CRC64, SHA256, SHA1, and BLAKE2sp.
How Do You Verify the Integrity of a File?
Checking the hash of the downloaded file is a quick and easy way to verify that your file is safe. If the downloaded file is malicious or has been tampered with in any way, the resulting hash will differ from the hash the website gives you.
Of course, not all websites offer you the chance to cross-reference a file hash to ensure file integrity.
In all honesty, most people don't take the time to vet their downloads, and as such, many major websites don't offer file hashing comparisons.
Also, many websites don't need to offer specific file hashing because they use integrated driver signing or a Certificate Authority to sign their software. In these cases, the operating system won't allow the software to install or run as it does not match an officially recognized software signature.
However, the system is far from perfect, which is why many people prefer to cross-reference their software using a file hash generation and checking tool.