guides / macos

Verify a checksum on macOS

Every Mac ships with shasum — no Homebrew, no Xcode. One command verifies a download; here it is step by step, plus a no-terminal alternative.

The one command

Open Terminal (⌘+Space, type "Terminal", Enter) and run:

shasum -a 256 ~/Downloads/ubuntu.iso

The path trick that makes this painless: type shasum -a 256 (with the trailing space), then drag the file from Finder into the Terminal window — macOS pastes the full, correctly escaped path. Output:

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  /Users/you/Downloads/ubuntu.iso

Compare that first field against the hash on the official download page. -a picks the algorithm: 1, 224, 256, 384 or 512 — match whatever the publisher listed (64 characters means SHA-256; the identifier decodes other lengths).

Verifying a whole SHA256SUMS file

When a release page offers a sums file covering several downloads, put it in the same folder as the files and run:

cd ~/Downloads && shasum -a 256 -c SHA256SUMS

Each file prints OK or FAILED. Files listed but not downloaded produce noisy warnings; that's normal, or use the batch tool which handles partial downloads gracefully.

Worth knowing

macOS's md5 prints BSD style — MD5 (file.iso) = 5d41… rather than hash-first. Same value, different order; tools that read sums files sometimes reject it. (Ours accepts both.)
openssl dgst -sha256 file is the always-available fallback, and the way to compute SHA-3 natively (-sha3-256).
Case never matters — A1B2… equals a1b2…. Every character position does.

Skip the terminal entirely

Drop the file into the verify tool and paste the expected hash: algorithm detected, comparison exact, nothing uploaded — it all runs inside your browser. The same steps exist for Windows and Linux, and what is a checksum explains what that match actually proves.

questions

Is shasum preinstalled on macOS?

Yes — every Mac ships with shasum (plus md5 and openssl dgst). No Homebrew, no Xcode tools needed. -a selects the algorithm: 1, 224, 256, 384 or 512.

How do I verify a SHA256SUMS file on a Mac?

cd into the folder holding both the sums file and the downloads, then run shasum -a 256 -c SHA256SUMS. Each listed file prints OK or FAILED. No terminal handy? The batch tool does the same in your browser.

Why does the md5 command print its hash differently?

macOS's md5 uses BSD tag format: MD5 (file.iso) = 5d41… rather than hash-then-filename. Same digest, different dressing — the verify tool accepts either format pasted whole.

How do I avoid typing the file path?

Type the command up to the trailing space, then drag the file from Finder into the Terminal window — macOS inserts the full escaped path. Or use the in-browser checker and skip Terminal entirely.

shasum: command not found — now what?

Rare, but it means Perl's been stripped from PATH. Use openssl dgst -sha256 file.iso instead — OpenSSL/LibreSSL is always present — or verify in the browser.