Check SHA-256 Hash on Mac: Compare Files in Terminal

To check a SHA-256 hash on a Mac, open Terminal and run shasum -a 256 followed by the file’s path. macOS prints the file’s 64-character SHA-256 digest; compare it with the trusted checksum supplied by the file’s publisher to see whether the contents match.

Check a File’s SHA-256 Hash in Terminal

The built-in shasum command is a straightforward way to calculate a SHA-256 digest without installing software. For example, if a file named download.zip is in your Downloads folder, enter:

shasum -a 256 ~/Downloads/download.zip

Press Return. The output will look broadly like this:

e3b0c44298fc1c149afbf4c8996fb924...  /Users/name/Downloads/download.zip

The long hexadecimal string is the hash. The example is shortened here; a SHA-256 digest has 64 hexadecimal characters. Your actual result depends on the file. Compare the entire digest, not just its first few characters, with a checksum obtained from a source you trust.

If you are unsure of the file’s path, type shasum -a 256 with a space after the command, then drag the file from Finder into the Terminal window. macOS inserts its path. Press Return to calculate the hash.

Use the macOS Command Line

To open Terminal, use Spotlight search or open it from Applications > Utilities. You do not need administrator privileges to calculate a hash for a file you can read. The command reads the file and reports a result; it does not modify the file.

1. Open Terminal.
2. Type shasum -a 256 followed by a space.
3. Enter the file path, or drag the file into the Terminal window.
4. Press Return and locate the digest at the start of the output.
5. Compare it character by character with the expected SHA-256 value.

The -a 256 option tells shasum to use SHA-256. Without that option, the command may use a different algorithm, so include it when you need a SHA-256 checksum. Spaces in file names are normally handled when a path is quoted or inserted by dragging the file into Terminal.

What the Hash Tells You

SHA-256 is a cryptographic hash function in the SHA-2 family. It processes input data and produces a fixed-length digest of 256 bits, usually written as 64 hexadecimal characters. The same exact file contents produce the same digest when calculated with SHA-256.

Even a small change to the file—such as altering one byte—will normally produce a very different digest. That makes a checksum useful for checking whether a download matches a published value or whether a file changed between two checks.

A matching hash is evidence that the file’s contents match the file represented by the expected digest. It does not prove that the file is safe, authentic, or free of harmful code. If an attacker can replace both the download and the checksum on the same compromised page, the two may still match. For stronger assurance, get the checksum through a separately trusted channel or verify a publisher’s digital signature when one is available.

Compare the Result Correctly

Copy the expected checksum from the publisher’s official documentation or download page, then compare it with the digest Terminal produced. Uppercase and lowercase hexadecimal letters represent the same values, but every character and the overall length must match. Watch for copied spaces, missing characters, and line breaks.

If you want Terminal to calculate hashes for two local files, run the command once for each file and compare the first field. You can also use a checksum file if the publisher supplies one, but the file’s format and verification instructions vary. Do not assume that every downloaded text file is a standard checksum manifest suitable for automatic checking.

To make a simple visual comparison easier, copy both values into a plain-text editor or use a trusted comparison tool. Avoid treating a partial match as verification: a few matching characters are not enough to establish that the full digest is identical.

Common Problems and Alternatives

If Terminal says the file cannot be found, check the path, spelling, and file extension. A file may have been saved somewhere other than Downloads. Dragging it into the command is often the simplest way to insert the correct path. If the command reports a permission error, check that your account can read the file and that it is not on an unavailable drive.

If you see an unexpected digest, first confirm that you calculated SHA-256 with -a 256, selected the intended file, and copied the publisher’s complete checksum. A download may be incomplete or may have been updated since the checksum was posted. Re-download from the trusted source and check whether its page provides a checksum for that exact version.

macOS also includes the openssl command on many installations, and a SHA-256 calculation can be made with openssl dgst -sha256 followed by a file path. For a basic check, shasum -a 256 is usually simpler and makes the selected algorithm explicit. Avoid third-party hash apps unless you have a reason to use one and trust its source.

SHA-256 Versus Other Checksums

Different hash algorithms produce different digests, so a SHA-256 value cannot be compared with an MD5 or SHA-1 value. Confirm that the publisher identifies the expected algorithm as SHA-256. The command’s -a 256 option is important for precisely that reason.

Checksums also differ from encryption. A hash is a one-way digest used to compare data; it is not a way to hide a file’s contents or recover them later. A checksum can help detect accidental corruption, while a trusted signature or independently obtained checksum can provide stronger evidence about origin. Neither makes it sensible to open an untrusted file without considering its source.

Frequently Asked Questions

How do I check a SHA-256 hash on a Mac?
Open Terminal and run shasum -a 256 followed by the file path. Compare the resulting 64-character digest with the expected SHA-256 value.

Does macOS have a built-in SHA-256 tool?
Yes. The shasum command is available in Terminal on macOS. Use -a 256 to request SHA-256 specifically.

Can I check a hash without typing the full path?
Yes. Type shasum -a 256 in Terminal, then drag the file from Finder into the window and press Return.

What if my hash does not match?
Verify the algorithm, file path, and full expected digest. The file may differ from the publisher’s version or the download may be incomplete; get the checksum and file again from a trusted source.

Does a matching SHA-256 hash prove a download is safe?
No. It shows that the file matches the digest you compared against. Safety and authenticity depend on whether that expected digest came from a trustworthy source.

Related

• How to Tell When an AI Chatbot Is Making Things Up
• Best Programming Language for Games: 5 Strong Picks
• Samsung OLED vs QLED vs Neo QLED: Which TV to Buy?