How to Verify a SHA256 Checksum of an Ubuntu ISO on Windows

Downloading an Ubuntu ISO is easy, but how do you know the file you received is complete and has not been changed on the way? A large download can stop early, a mirror can serve a damaged copy, or in rare cases a file can be replaced with something unsafe. Checking the checksum takes less than two minutes on Windows, needs no extra software, and gives you a clear yes or no before you write the ISO to a USB stick or start an install.

Quick Answer

Open PowerShell in the folder where the ISO is saved, run Get-FileHash .\ubuntu-24.04-desktop-amd64.iso -Algorithm SHA256, and copy the long hash it shows. Compare that hash, character by character, with the value published next to the same file in the official SHA256SUMS list for that Ubuntu release. If the two values match exactly, your ISO is genuine and complete. If they differ at all, delete the file and download it again.

What a SHA256 Checksum Actually Is

A checksum is a fingerprint for a file. The SHA256 method reads every byte of the ISO and turns it into a code made of 64 letters and numbers. The code looks random, but it is not random at all. The same file will always produce the same code on any computer in the world.

Change even one small part of the file and the fingerprint changes completely. That is why this test is so useful. It cannot tell you who made a file, but it can prove that the copy on your disk is bit-for-bit identical to the copy Ubuntu published.

Why This Matters More Than File Size

Many people check only the file size. That is not enough. A corrupted or altered file can have exactly the same size as the original. Two files can also share the same name and still be different inside. The hash is the only simple check that looks at the whole content, which is why Ubuntu publishes these values for every release.

What You Need Before You Start

• A finished download of the Ubuntu ISO, not a file that is still downloading.
• The exact Ubuntu version and edition in the file name, such as desktop or server.
• Windows 10 or Windows 11 with PowerShell, which is built in by default.
• About two minutes, although larger ISOs on slower drives can take a little longer to scan.

Close any tool that is still writing to the file, such as a torrent program seeding or downloading it. The hash will keep changing while the file is incomplete, so wait for the download progress to show one hundred percent first.

Step 1: Get the Official Hash From Ubuntu

Always get the expected hash from Ubuntu itself, never from the same random site where you found the ISO. If a bad copy came from an untrusted source, its listed hash could match the bad file and hide the problem.

1. Go to the Ubuntu release download area for your version.
2. Open the SHA256SUMS file listed beside the ISO downloads.
3. Find the line that ends with the exact name of your ISO file.
4. Keep that page open, or copy the line into Notepad for easy comparison.

The official Ubuntu guide to verifying your download walks through this same idea and explains where the checksum files live for each release. Following that source keeps you away from copied lists on forums, which can be old or edited.

Step 2: Calculate the Hash in PowerShell

Windows already includes the tool you need, called Get-FileHash. You do not need to install a checker program, and you should avoid downloading small unknown utilities for a job Windows can do itself.

1. Open File Explorer and go to your Downloads folder, or wherever the ISO is saved.
2. Click the address bar, type powershell, and press Enter. PowerShell opens already pointed at that folder.
3. Type Get-FileHash .\FILENAME.iso -Algorithm SHA256, replacing FILENAME with your real file name, and press Enter.
4. Wait while Windows reads the file. The cursor may sit quietly for a short time on older hard drives.
5. Read the result. PowerShell shows the algorithm, the hash value, and the file path in a small table.

If typing the long file name is awkward, type the first few letters and press Tab. Windows will complete the name for you. Be careful to include the full name, including the .iso ending, otherwise PowerShell will report that it cannot find the file.

Using Command Prompt Instead

If you prefer the older Command Prompt window, the built-in certutil tool does the same job. Run certutil -hashfile FILENAME.iso SHA256 and Windows prints the hash in blocks, usually without spaces in newer versions. Both tools should give you the identical result for the same file, so use whichever window you are more comfortable with.

Step 3: Compare the Two Values Carefully

This is the step people rush, and it is the step that decides everything. The two codes must match in every position. Length alone is not a pass, and a near match is still a fail.

1. Select the hash in PowerShell, copy it with Ctrl+C, and paste it into Notepad.
2. Paste the official hash on the line below it.
3. Check the first eight characters, the middle section, and the last eight characters slowly.
4. Ignore capital letters. PowerShell often shows capitals, Ubuntu lists small letters, and case makes no difference.
5. Remove spaces if one result is grouped in blocks. Spaces are only for display.

A safer trick is to use PowerShell to compare for you. Save the official value in a variable and let the computer check equality, which removes human eye errors entirely when you paste both values correctly.

When the values match, you can move on with confidence to creating a bootable Ubuntu USB drive on Windows with Rufus, knowing the source file is sound.

If the Hash Does Not Match

A mismatch does not automatically mean someone attacked you. The most common causes are ordinary: an interrupted download, a browser that saved a partial file, or checking the hash of the wrong release, such as comparing a 24.04 ISO against a 22.04 list.

Work through this order before worrying:

1. Confirm the file name in the SHA256SUMS list matches your file exactly, including desktop versus server.
2. Check the download finished and the file is not still open in a torrent app.
3. Run the hash command again to rule out a typing mistake.
4. Delete the ISO and download it again, ideally from the official Ubuntu desktop download page.
5. Verify the new copy before doing anything else with it.

Never ignore a repeated mismatch to save time. Installing from a damaged ISO can fail halfway, refuse to boot, or install a system that behaves strangely in ways that are hard to trace back to the download.

Common Mistakes and Useful Tips

• Checking the wrong file: Browsers sometimes add a number in brackets to a second copy. Make sure you hash the file you will actually use.
• Using MD5 by habit: Older guides mention MD5. Ubuntu now publishes SHA256, which is far stronger, so always select that algorithm.
• Trusting a hash from a video description: Only the publisher’s own list counts as the reference value.
• Hashing a mounted or extracted folder: The checksum applies to the single ISO file, not to files you pulled out of it.
• Stopping after the first few characters look right: Compare the end too. A fake or damaged value rarely matches throughout.

Tip: verify every operating system ISO you download, not just Ubuntu. Windows, Debian, Fedora, and Linux Mint all publish hashes, and the habit costs almost no time once you know the command.

Conclusion

Verifying a SHA256 checksum on Windows is a small step with a big payoff. One built-in PowerShell command creates a fingerprint of your ISO, and comparing it with Ubuntu’s published value proves the file is complete and unchanged. If it matches, install with confidence. If it does not, download again and test the fresh copy. That two-minute check protects you from wasted installs and avoidable risk.

Frequently Asked Questions

How long does it take to hash an Ubuntu ISO?

On a modern SSD it usually takes a few seconds to about a minute. Older hard drives and very large files take longer because Windows must read every byte of the file to build the fingerprint.

Does a matching checksum guarantee the ISO is safe?

It guarantees your copy matches the publisher’s copy exactly, provided you took the expected hash from Ubuntu’s official site. That is why the source of the reference hash matters as much as the match itself.

Why does my hash have capital letters but Ubuntu uses small letters?

Case does not matter in these values. A, B, and C in capitals mean the same as a, b, and c in small letters. Only the order and choice of characters count.

Can I verify the ISO after writing it to a USB stick?

The published checksum is for the ISO file, not the finished USB stick, because writing tools add boot structures. Verify the file before you write it, then rely on the writing tool’s own verification option if it offers one.

What should I do if the hash keeps failing after several downloads?

Try a different official mirror, a wired connection instead of weak Wi-Fi, and a different browser or download tool. If every copy fails, check your drive for errors, because failing storage can corrupt large files as they are saved.