How to verify the checksum in Linux

Checksum is a software-derived text string using a hash function. No two checksums are the same. When downloading software from the Internet, one way to verify software integrity is to compare the software's checksum with the checksum provided by the website. If the results match, the software is genuine and has not been tampered with.

While this can be easily done in Terminal, you'll learn here how GtkHash graphical engine checksum can be checked and verified incredibly simple.

1. Install GtkHash

For most Linux distributions, you can find GtkHash in the package manager or Software Center. If you are using Ubuntu or a compatible distro and installed from Terminal, you can install GtkHash with:

sudo apt install gtkhash

As for openSUSE, you will have to add its repository prior to installation.

On Arch and Manjaro:

sudo pacman -S gtkhash

Once installed, find this app among installed apps and run it.

2. Generate hashes

GtkHash's interface is quite simple. To calculate hashes for one or more files, click the Add button at the top left.

How to verify the checksum in Linux Picture 1

Point to the location of the files and select them. You can select multiple files by holding down the Ctrl key while clicking on them. Then, click the Open button at the top right to complete the command.

How to verify the checksum in Linux Picture 2

You can select as many files as you like

The list of GtkHash will be populated with the files you have selected. If you want, you can add more files by repeating the previous step.

Click the Hash button at the bottom right of the GtkHash window to compute the hash for all files in the list.

GtkHash calculates many types of hashes by default and displays them in the columns next to each file.

To copy the file's hash to the clipboard, right-click on the file and choose your preferred hash type from the Copy Digest submenu . Then, paste the copied hash somewhere for future reference.

How to verify the checksum in Linux Picture 3

Alternatively, you can save the hash to a file via File> Save As .

3. Check hash

To check the file's data integrity with GtkHash, choose File> Open and choose the hash file that comes with the main file. The hash file will usually have the extension sha1, md5 or sfv and GtkHash supports all the popular extensions.

Once the file is loaded, click the Hash button in the lower right. GtkHash will compute and compare the file's hash with the reported hash and show you the result. As you can see in the screenshot, there are 2 matches and 2 no matches.

How to verify the checksum in Linux Picture 4

4. More hashing types

GtkHash comes with the most common hashing algorithms enabled, but they are not the only ones it supports. For more, go to Edit> Preferences .

You can choose from over two dozen different hashes, of which you will probably find the one you like.

5. Compare the checksum from the Terminal

If you are in a server environment, the only way to compare the checksum is through Terminal. Fortunately, checking and generating hash files on Terminal is just as easy as using the GUI. Most distributions come with a set of tools for this purpose. Some of the most popular options are:

1. md5sum
2. shasum
3. sha256sum
4. sha384sum
5. sha512sum

The uses are simple because they work the same way: You enter their name, then the name of the file for which you want to calculate the hash. For example, to compute the SHA-512 hash for the downloaded Arch Linux installation ISO, the example uses:

sha512sum archlinux-2020.05.01-x86_64.iso

Above, sha512sum is the command for the hash algorithm used. After a while of waiting, the SHA-512 hash appeared on the screen.

In the future, you may want to check your files again, so export the results to a file instead of the screen. Hash commands do not provide such functionality as it is only redirected in Linux. By using the > icon after the command and file name, the output of the command will be saved in the file instead of being output to the screen. You can also use sha256sum:

sha256sum archlinux-2020.05.01-x86_64.iso > archlinux-2020.05.01-x86_64.iso.sha256

This will output the output to a typical text file that you can test. Inside, you will see the file's hash followed by the file name.

How to verify the checksum in Linux Picture 5

Checking file versus hash only requires you to add switch -c to the command and use the file hash instead of the real file. In other words something like this:

sha256sum -c archlinux-2020.05.01-x86_64.iso.sha256

Although verifying the checksum in Linux is easy, it is impractical to check the hash for each file. That's what you should do for sensitive data or Linux ISOs that you have downloaded from the web.

David Pac

Update 23 September 2020