The sha256sum & md5sum command in Linux
A checksum is a short fingerprint computed from a file's bytes: change one bit and the fingerprint changes completely. sha256sum is today's standard for verifying downloads against published hashes and for proving two files are identical without comparing them byte-by-byte. md5 survives for quick non-security fingerprinting only.
How sha256sum & md5sum works
A cryptographic hash digests any input into a fixed-size fingerprint with engineered properties: a one-bit input change flips about half the output bits (avalanche), finding an input for a given hash is infeasible (preimage resistance), and finding two inputs sharing a hash is infeasible (collision resistance). Verification works because these properties make "same hash" and "same bytes" practically synonymous.
The tools stream: input is processed in blocks through compression rounds, so hashing a 50 GB image needs constant memory. MD5's fall was collision resistance specifically: colliding pairs can be manufactured, which kills it for security (an attacker could craft a malicious file matching a published hash) while leaving it serviceable for accident detection like dedup and change tracking. SHA-256 is the current line; publishing hashes over HTTPS matters, since a hash fetched over the same compromised channel as the file verifies nothing.
Syntax
sha256sum [FILE...] | sha256sum -c SUMS.txtCommon options
| Option | What it does |
|---|---|
sha256sum file | Print hash and filename. |
-c FILE | Check files against a list of expected hashes. |
--quiet | With -c: only report failures. |
md5sum / sha1sum | Faster, weaker: fine for dedup, not for security. |
How to use sha256sum & md5sum: examples
$ sha256sum ubuntu-24.04.isoCompare the output with the hash published on the download page: match means intact and untampered.
$ sha256sum -c SHA256SUMS 2>/dev/null | grep -v OKVerify a whole release; show only problems.
$ sha256sum original.bin copy.binIdentical hashes = identical files, however far apart they live.
$ find . -type f -exec md5sum {} + | sort | uniq -w32 -dDuplicate-file hunt: same hash prefix appearing twice.
Real-world use cases for sha256sum & md5sum
Trust-but-verify downloads
Every ISO and installer: sha256sum file, compare against the vendor page (fetched over HTTPS). Two seconds that rule out corruption and tampering: non-negotiable for anything that will run privileged.
Proving a faithful transfer
After migrating a 200 GB dataset: sha256sum on both ends, diff the outputs. Matching hashes are mathematical proof the copy is exact: the sign-off that lets you delete the source.
Pro tips and common mistakes
- sha256sum -c SUMS automates whole-release verification; pipe through grep -v OK to see only failures.
- md5 for accident detection only; anything security-adjacent gets SHA-256.
- A hash is only as trustworthy as its channel: take it from the official HTTPS page, not the mirror serving the file.
Frequently asked questions about sha256sum & md5sum
Why verify downloads at all?
Corruption in transit and compromised mirrors both happen. A matching hash from the official page rules out both in two seconds.
Is md5 broken?
For security, yes: collisions are practical. For "did this file change since yesterday", it remains fast and fine.
Hashes match but content should differ?
Then it doesn't: matching SHA-256 means identical bytes. Check you hashed the files you meant to.
Things people do with sha256sum & md5sum
Download files with curl while preserving the remote filename and handling redirects.
Download a file with wgetDownload files from HTTP or HTTPS with wget and save them to a chosen location.
Identify a file type in LinuxUse file to identify text, archives, executables and other file formats from the command line.
Related commands
Locate files anywhere in a directory tree by name, type, size, date, and act on them.
curlDownload files, test APIs, send POST requests with JSON, and inspect headers.
diffSee exactly what changed between two files or trees: the language of patches.