Verify a SHA-256 checksum on Windows, macOS or Linux

A checksum is a fingerprint of a file. If your copy produces a different fingerprint to the one on the download page, the file changed on the way to you — a dropped byte, a proxy that rewrote it, or something worse. Do not install it.

Windows (PowerShell)

Get-FileHash .\plugin.zip -Algorithm SHA256

Right-click the zip → Properties → Security → Object name gets you the path if you are not in the folder. Copy the Hash column.

macOS

shasum -a 256 plugin.zip

Linux

sha256sum plugin.zip

Compare the strings

The output is 64 hexadecimal characters. Compare it with the checksum printed on the resource page. Case does not matter; whitespace does not exist in the string, so if you see spaces you have copied a line break with it.

Two shortcuts:

# Linux: let the tool compare for you
echo "PUBLISHED_HASH  plugin.zip" | sha256sum -c -

# macOS
echo "PUBLISHED_HASH  plugin.zip" | shasum -a 256 -c -

Both print OK when they match.

If it does not match

1. Re-download. Most mismatches are an interrupted download.
2. Check you are looking at the checksum for that version, not the previous one. Each release has its own.
3. If it still differs after a clean download, stop. Ask us — do not install it and do not try to "fix" it.

Why SHA-256 and not MD5

MD5 collisions are cheap to produce, so an MD5 checksum can no longer prove anything about a file's origin. SHA-256 has not been broken in that way, and every modern OS computes it out of the box.