How to Fix a "Checksum Verification Failed" Error

A cryptographic hash like SHA-256 turns any file into a fixed-length string. Change even a single byte and the resulting hash changes completely, so it is an extremely sensitive corruption detector. Matching hashes give you strong confidence that your download is complete and untampered.

It is worth knowing that MD5 and SHA-1 are now considered weak against deliberate tampering, though they are still fine for catching accidental corruption. Whenever a vendor offers SHA-256, prefer it over MD5 for security-sensitive downloads such as operating system images.

Windows ships with two built-in tools, so you rarely need to install anything. In Command Prompt, run certutil -hashfile yourfile.iso SHA256. In PowerShell, run Get-FileHash yourfile.iso -Algorithm SHA256. Both print the file's hash, which you then compare against the value on the vendor's download page.

Comparison is case-insensitive but otherwise must be exact. Copy the vendor's value into a text editor next to your result, or use PowerShell's comparison to avoid eye strain when checking 64-character strings.

A mismatch is not something to override or ignore. The most likely explanation is a corrupted download, so the first move is simply to delete the file and download it again, ideally over a stable wired connection or using a download manager that verifies integrity.

If the freshly downloaded file still fails to match the official hash, treat it as suspicious. The mirror could be compromised, the published value could be outdated, or the file could be intentionally modified. Switch to the official primary source and report the discrepancy to the vendor.

Sometimes the checksum genuinely fails because you are comparing against the wrong number. Vendors release new versions frequently, and an old hash on a forum post will not match a current build. Always copy the checksum from the same official page and version that hosts the download.

Watch for the algorithm too — comparing your SHA-256 result against the vendor's MD5 value will obviously never match. Confirm both strings use the same algorithm before concluding anything is wrong.

For the highest-security downloads, vendors also publish a GPG or PGP signature. A signature proves not only that the file is intact but that it genuinely came from the publisher, because it is cryptographically tied to their private key. Tools like Gpg4win let you verify these signatures on Windows.

Signature verification is more involved than a simple hash check, but for things like Linux ISOs, cryptocurrency wallets, or security software, it is the gold standard for confirming authenticity.