Verify a file's SHA-256 checksum on Mac

Confirm a downloaded ISO, DMG or installer matches the publisher's official hash.

macOSTerminalLow risk

Run the command below — compare the printed 64-character hash with the one on the publisher's site; a match means the file is intact.

01Command

Command

$ shasum -a 256 ~/Downloads/installer.dmg

02What it does

A SHA-256 digest is a fingerprint of the file's bytes: if even one bit changed in transit or on a compromised mirror, the hash differs. shasum -a 256 prints it; most project pages publish the expected value to compare by eye, or save it to a file and run shasum -a 256 -c checksums.txt. Use MD5 (md5 file) only where the publisher offers nothing better — it is collision-prone.

03Risk

RiskLow risk

RequirementsYou need the official checksum value from the download page to compare against.

CompatibilitymacOS 10.11 El Capitan – 15 Sequoia

!Warning: A checksum only proves integrity against the published hash — if the site itself is compromised, the published hash is too.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

macOS shasum command reference
SS64 · technical · 2026-09-16
Evidence: shasum -a 256 prints the SHA-256 digest of a file; matching digests confirm the file is byte-identical to the original.

Last verified: 2026-09-16 · Category: Security & Privacy