The sha256sum & md5sum command in Linux
A checksum is a short fingerprint computed from a file's bytes: change one bit and the fingerprint changes completely. sha256sum is today's standard for verifying downloads against published hashes and for proving two files are identical without comparing them byte-by-byte. md5 survives for quick non-security fingerprinting only.
How sha256sum & md5sum works
A cryptographic hash digests any input into a fixed-size fingerprint with engineered properties: a one-bit input change flips about half the output bits (avalanche), finding an input for a given hash is infeasible (preimage resistance), and finding two inputs sharing a hash is infeasible (collision resistance). Verification works because these properties make "same hash" and "same bytes" practically synonymous.
The tools stream: input is processed in blocks through compression rounds, so hashing a 50 GB image needs constant memory. MD5's fall was collision resistance specifically — colliding pairs can be manufactured — which kills it for security (an attacker could craft a malicious file matching a published hash) while leaving it serviceable for accident detection like dedup and change tracking. SHA-256 is the current line; publishing hashes over HTTPS matters, since a hash fetched over the same compromised channel as the file verifies nothing.
Syntax
sha256sum [FILE...] | sha256sum -c SUMS.txtCommon options
| Option | What it does |
|---|---|
sha256sum file | Print hash and filename. |
-c FILE | Check files against a list of expected hashes. |
--quiet | With -c: only report failures. |
md5sum / sha1sum | Faster, weaker — fine for dedup, not for security. |
How to use sha256sum & md5sum: examples
$ sha256sum ubuntu-24.04.isoCompare the output with the hash published on the download page — match means intact and untampered.
$ sha256sum -c SHA256SUMS 2>/dev/null | grep -v OKVerify a whole release; show only problems.
$ sha256sum original.bin copy.binIdentical hashes = identical files, however far apart they live.
$ find . -type f -exec md5sum {} + | sort | uniq -w32 -dDuplicate-file hunt: same hash prefix appearing twice.
Real-world use cases for sha256sum & md5sum
Trust-but-verify downloads
Every ISO and installer: sha256sum file, compare against the vendor page (fetched over HTTPS). Two seconds that rule out corruption and tampering — non-negotiable for anything that will run privileged.
Proving a faithful transfer
After migrating a 200 GB dataset: sha256sum on both ends, diff the outputs. Matching hashes are mathematical proof the copy is exact — the sign-off that lets you delete the source.
Pro tips and common mistakes
- sha256sum -c SUMS automates whole-release verification; pipe through grep -v OK to see only failures.
- md5 for accident detection only; anything security-adjacent gets SHA-256.
- A hash is only as trustworthy as its channel — take it from the official HTTPS page, not the mirror serving the file.
Frequently asked questions about sha256sum & md5sum
Why verify downloads at all?
Corruption in transit and compromised mirrors both happen. A matching hash from the official page rules out both in two seconds.
Is md5 broken?
For security, yes — collisions are practical. For "did this file change since yesterday", it remains fast and fine.
Hashes match but content should differ?
Then it doesn't: matching SHA-256 means identical bytes. Check you hashed the files you meant to.
Related commands
Locate files anywhere in a directory tree by name, type, size, date — and act on them.
curlDownload files, test APIs, send POST requests with JSON, and inspect headers.
diffSee exactly what changed between two files or trees — the language of patches.