You found the official website, clicked the right button and the file is sitting in your Downloads folder. How do you know it is the file the developer actually published, and not a corrupted copy or something swapped along the way? This Adescargar guide shows you three ways to verify a download, from a ten-second check anyone can do to the signature checks security teams rely on, with the exact commands for Windows, macOS and Linux.
- A checksum (usually SHA-256) proves the file was not altered or corrupted. Compare it with the value on the official site.
- A digital signature proves who published the file. Check the signer name on Windows, notarisation on Mac, or a PGP signature for open-source projects.
- A malware scan checks reputation. It is useful, but it is the last line of defence, not the first.
- For the most important downloads, use at least two of the three methods.
Why verifying downloads matters
Most downloads are fine. Verification is for the cases that are not, and you cannot tell those apart by looking at the file name.
- Tampered mirrors and fake sites. A copy of an installer can be modified and re-hosted on a site that looks legitimate.
- Hijacked updates. Between June and December 2025, attackers who compromised the hosting provider used by Notepad++ were able to redirect update requests for selected users to malicious servers. The project’s response was to make its updater verify certificates and signatures, which is exactly the check this guide teaches you to do by hand.
- Bait-and-switch download buttons. Some download portals send you a different program from the one advertised. A quick look at the file’s details or signature exposes it immediately.
- Plain corruption. A large ISO or installer can be damaged in transit. A checksum mismatch saves you from a confusing failed install.
Method 1: Compare the checksum (hash)
A checksum is a short fingerprint calculated from every byte in a file. Change a single byte and the fingerprint changes completely. Many projects, including VLC, LibreOffice and most Linux distributions, publish a SHA-256 checksum next to each download.
Windows (PowerShell)
Open PowerShell in the folder that contains the file and run:
Get-FileHash .\installer.exe -Algorithm SHA256If you prefer Command Prompt, the built-in certutil tool does the same job:
certutil -hashfile installer.exe SHA256macOS (Terminal)
shasum -a 256 ~/Downloads/app.dmgLinux
sha256sum ubuntu.isoIf the project provides a SHA256SUMS file, you can check everything in one go with sha256sum -c SHA256SUMS --ignore-missing.
Comparing the result
Copy the hash from the official download page and compare it with your output. Every character must match; letter case does not matter. You do not have to compare by eye: in PowerShell you can let the computer do it.
(Get-FileHash .\installer.exe -Algorithm SHA256).Hash -eq "PASTE-THE-OFFICIAL-HASH-HERE"A result of True means the file matches.
If an attacker controls the website, they can change the file and the checksum on the same page. Checksums are excellent at catching corruption and tampered mirrors. To prove who published a file, you need a signature (Method 2).
MD5 and SHA-1: some older sites still publish these. They are fine for spotting accidental corruption, but both algorithms are broken for security purposes. Prefer SHA-256 or SHA-512 whenever the developer offers them.
Method 2: Check the digital signature
A digital signature ties a file to the organisation that published it. It is much harder to fake than a checksum, because the attacker would need the developer’s private signing key.
Windows: Authenticode signatures
- Right-click the downloaded
.exeor.msiand choose Properties. - Open the Digital Signatures tab. If the tab is missing, the file is not signed.
- Select the signature and click Details. The message should say “This digital signature is OK”, and the signer name should match the developer.
- Open the Details tab of the Properties window as well, and confirm that the product name and company match what you meant to download.
When you run a signed installer, the User Account Control prompt shows Verified publisher with the developer’s name. “Publisher: Unknown” is a reason to stop and double-check. You can also check from PowerShell:
Get-AuthenticodeSignature .\installer.exe | Format-List Status, SignerCertificateRemember that a valid signature proves who signed the file, not that it is the program you wanted. Some adware is properly signed. Always check that the signer is the company you expected.
macOS: Developer ID and notarisation
Mac apps distributed outside the App Store are signed with an Apple Developer ID and notarised, which means Apple has scanned them for known malware. Gatekeeper checks this automatically when you first open an app. To check it yourself:
spctl -a -vv /Applications/AppName.appA healthy result says accepted and source=Notarized Developer ID, followed by the developer’s name. For more detail about the signature:
codesign -dv --verbose=4 /Applications/AppName.appIf macOS refuses to open an app, do not reach for a workaround straight away. Since macOS Sequoia, approving an unsigned app requires a trip to System Settings, under Privacy & Security, and clicking Open Anyway. Only do that for an app whose source you have already confirmed.
Open-source projects: PGP/GPG signatures
Many open-source projects sign their releases with a PGP key and publish a .asc or .sig file alongside the download. With GnuPG installed:
gpg --verify file.tar.gz.asc file.tar.gzLook for “Good signature” and check that the key fingerprint matches the one the project publishes on its official website or documentation. A warning that the key is “not certified with a trusted signature” is normal if you have not personally signed the developer’s key; the fingerprint comparison is what matters.
Android: APK signatures
Every Android app is signed by its developer. If you install an update to an app, Android refuses it unless it is signed with the same key, which protects you from swapped updates. To inspect an APK before installing it, the apksigner tool from the Android SDK build tools prints the signing certificate:
apksigner verify --print-certs app.apkCompare the certificate’s SHA-256 digest with the one published by the developer, where available.
Method 3: Scan the file
Scanning checks whether a file is already known to be malicious. It cannot prove a file is genuine, but it catches a lot.
- Microsoft Defender scans downloads automatically. You can also right-click any file and choose Scan with Microsoft Defender.
- VirusTotal checks a file against dozens of antivirus engines. Search by the file’s SHA-256 hash first: if the file is widely used, a report may already exist and you do not need to upload anything.
Files uploaded to VirusTotal can be shared with security researchers. Never upload private documents, work files or anything containing personal data. Searching by hash shares nothing.
How to read the results
- 0 detections: a good sign, but not a guarantee. Brand-new malware may not be recognised yet.
- 1 or 2 detections from lesser-known engines: often a false positive, especially for small open-source tools. Cross-check the signature and source before deciding.
- Several detections from major engines, or labels such as “Trojan”, “Stealer” or “PUA” (potentially unwanted application): delete the file.
Red flags you can spot without any tools
- Double extensions such as
invoice.pdf.exe. Turn on “File name extensions” in File Explorer’s View menu so you always see the real extension. - A tiny installer for a large program, which often means it is a downloader for something else.
- A password-protected ZIP with the password on the download page. This trick exists to hide the contents from scanners.
- An installer inside an ISO or IMG file when the developer normally ships a plain
.exeor.dmg. - Instructions to disable your antivirus before running the file.
Which method should you use?
| Situation | Minimum check | Best practice |
|---|---|---|
| App from Microsoft Store, Mac App Store, Google Play or App Store | None needed: the store verifies it | Check the developer name on the listing |
| Installer from the official website | Signature and file details | Signature plus checksum |
| Download from a mirror or GitHub release | Checksum from the official site | Checksum plus PGP signature |
| Operating system image (ISO) | Checksum | Checksum plus signed checksum file |
| File sent by someone else | Scan by hash | Get it from the official source instead |
Frequently asked questions
What is a checksum in simple terms?
A checksum is a unique fingerprint calculated from a file’s contents. If your file produces the same SHA-256 checksum as the one published by the developer, the file has not been changed or corrupted.
Is SHA-256 better than MD5?
Yes. MD5 and SHA-1 can be deliberately forged, so they are only suitable for spotting accidental corruption. SHA-256 is the current standard for verifying downloads.
Can a signed file still be malware?
Yes. A signature proves who published a file, not that the publisher is trustworthy. Check that the signer is the company you expected, and combine the signature check with an official source.
Is it safe to upload files to VirusTotal?
It is safe for public installers, but uploaded files can be shared with security researchers, so never upload private or work documents. Searching by hash is a private alternative when a report already exists.
Do I need to verify apps from official app stores?
Not usually. Official stores check signatures and scan apps for you. Just make sure the developer name on the listing is the real one, since copycat apps do exist.
Put it into practice
Our complete guide shows how verification fits into a safe download routine, from finding the official site to updating and uninstalling.
