Check that a file, image or text is what it claims to be

Hands-on steps for Windows, Mac and Linux, from file checksums to content credentials.

Published digestSHA-256 of an empty file

Equal in all eight groups. One changed byte would change every one of them.

Your copyprinted by the command on your machine

Checking an image or text instead?

SHA-256, 64 of 64Match

Every character agrees. Your file is the one that was published.

Check a file or download

Flat geometric drawing of a workbench: a downloaded file beside its published fingerprint, a photo under a magnifier with a provenance label, and a document with a dated seal. — The same bench, three kinds of object. Each one has a label you can check it against.

What are you holding?

Find the thing in front of you. Teal is a file or download; orange is a picture, a document or text.

The evidence ladder

Six kinds of evidence, strongest first. The top rungs can prove a fact; the bottom rungs can only tell you where to look.

Digital signature
Proves the file came from the holder of a signing key and has not changed since it was signed.
Strength: Proof of origin
File hash
Proves your copy is identical, bit for bit, to the copy the published hash was taken from.
Strength: Proof of sameness
Content credential
Records who made or edited an image and with what, signed so that later changes show.
Strength: Signed history
Metadata
Says which camera, app or date produced a file. Anyone with an editor can rewrite it.
Strength: Claim, editable
Watermark
Can suggest a known AI tool made it, if the mark survived editing and you have a way to read it.
Strength: Hint
Detector score
A statistical guess. It can tell you to look closer; on its own it proves nothing.
Strength: Estimate

1 is proof6 is an estimate

Checksums

All checksum guides

The original check: compute a file's fingerprint and compare it with the one the publisher posted.

Explainer
What is a checksum?
A short fingerprint computed from every byte of a file, and why one changed byte changes all of it.
How-to
How to verify a download
Find the published hash, compute your own on your system, and compare every character.
How-to
Checksum mismatch
What a different hash means, the harmless causes, and when to delete the file.
Explainer
MD5, SHA-1, SHA-256 compared
Which algorithm to rely on today, and which only catch accidents.

Verify content

All verify content guides

The same habit for photos, documents and drafts: look for signed records first, and treat guesses as guesses.

How-to
Read a C2PA manifest yourself
Open a photo's provenance record and read each claim, signature and hash it carries.
Explainer
Is this image AI-generated? A verification checklist
Work down from credentials and metadata to visual clues, and know where proof stops.
How-to
Prove you wrote it: hash and timestamp your drafts
Keep a dated, hashed record of each draft so you can show your work later.
How-to
Verify an AI model download
Check large model files against the digests the hub publishes before you load them.

What happened to HashTab

HashTab put a file's hashes in a tab of the Properties dialog, and many old forum posts still say to check with it.

There is no HashTab download on this site, and you do not need one.

Windows, macOS and Linux each ship a command that prints the same SHA-256.

The full HashTab story HashTab alternatives compared

Built in, nothing to install. Replace file.iso with the name of your file.

WindowsPowerShell

Get-FileHash .\file.iso -Algorithm SHA256

MacTerminal

shasum -a 256 file.iso

LinuxTerminal

sha256sum file.iso

Diagram: on the left a download and its published SHA-256; on the right a photo inside a credential frame with the SHA-256 of the image stored beneath it; an equals disc joins the two digests.

One hash, two jobs

The SHA-256 that checks a download is also the core of a content credential. Learn the first and you already understand the second.

Check a download

The publisher posts a digest. You compute yours. Equal means your file is the one they published.

Same function, same rule: change one byte and the digest changes.

Anchor a content credential

The credential stores a digest of the image and signs it. A validator recomputes it. Equal means the content is what was signed.

From checksums to content credentials

New and updated

Recently added or updated guides.
Date	Entry	Figure
__NODATE__	Check a file's hash on Windows 10 and 11 PowerShell and Command Prompt, with the output you should see.
__NODATE__	Check a hash on a Mac One Terminal command, and how to compare the result without squinting.
__NODATE__	Check content credentials See who signed an image, which edits it records, and what a broken credential means.
__NODATE__	Perceptual hash vs SHA-256 Why a resized photo still matches one kind of hash and not the other.

From the archive

Older sysadmin notes from this domain, refreshed and kept at the addresses old links expect.

2012/active-directory/2012/04/13/

Don't rejoin to fix a broken trust relationship

Repair a computer's secure channel with the domain instead of removing and rejoining it. Originally published April 2012, refreshed 2026.

Tool/varpanel/

Varpanel and Windows environment variables

What the utility did, and how to view and edit environment variables with what Windows already has.

A manual for checking things

Every guide shows the exact command, the system it applies to and the sources behind it. Strong evidence is called strong; a guess is called a guess.

About Implbits