Text processing

`sha256sum`

Compute SHA-256 checksums of files, or verify files against a list of checksums with -c.

sha256sum [OPTION...] [FILE...]

12 of 12 examples run in Debian 13.7 on 2026-10-31 · coreutils 9.7-3 · manual: sha256sum(1)

sha256sum reads a file and prints its SHA-256 hash: 64 hex digits that change completely if a single byte of the file changes. Two files with the same hash have the same content, for all practical purposes. The output format is the hash, two spaces and the file name, and that same format is what sha256sum -c reads back to verify files.

Use it to check that a download matches the checksum its publisher lists, that a copy or a backup is intact, or to detect which files changed between two runs. SHA-256 is the current default for this; md5sum and sha1sum work the same way but are broken for security purposes. Siblings sha224sum, sha384sum and sha512sum take the same options.

A checksum only proves integrity if you got the expected value from a trustworthy place. A checksum file downloaded from the same server as the file proves nothing against a compromised server; that is what signatures (GPG, minisign, sigstore) are for.

Examples

Hash a file

$ sha256sum todo.txt

explain

output

328f70102b0d08bbdea3cbb5b0e70339167d51a8260a023be34668b70f303ffe  todo.txt

The 64-character hex digest comes first, then two spaces and the file name.

Hash several files at once

$ sha256sum photos/*.png

explain

output

cfe1499051d4b71d94a5ad48ea9e88fd6408f0bfe3965f1ef4725efe5f84066e  photos/IMG_2041.png
e6a3a3bae8368ec5ca403457c39e5dda8530857e26ee94e4472a4b375dfcee6d  photos/beach.png
6a695ca85efe79803094b5f271c24f2427883f4d2603aa899346bd0616fbf7ca  photos/forest.png

Each file gets its own line, in the same format, so the output can be saved and checked later.

Save checksums to a file

$ sha256sum data/*.csv > SHA256SUMS
> cat SHA256SUMS

output

7bbce1a5d4dac19cd33f75bc0ab6b4d8397a05a47b8681f9c0f14a36dd3540bb  data/sales.csv
a2f17aba5d694218a3a25a9a3ceba05e13b67db432b3ba9edabf409daac7c21a  data/users.csv

SHA256SUMS is the conventional name for such a list; Linux distributions publish their ISO checksums the same way.

Verify files against a checksum list

$ sha256sum data/*.csv > SHA256SUMS
> sha256sum -c SHA256SUMS

output

data/sales.csv: OK
data/users.csv: OK

-c recomputes each file's hash and compares it with the list, printing OK for every match.

Detect a modified file

$ sha256sum data/*.csv > SHA256SUMS
> echo '9,Ivan Petrov,ivan@example.com,sales,2026-03-20' >> data/users.csv
> sha256sum -c SHA256SUMS

outputexit 1

data/sales.csv: OK
data/users.csv: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

After a line is appended to users.csv, its hash no longer matches. sha256sum marks it FAILED, prints a warning summary and exits with status 1.

Report only problems

$ sha256sum data/*.csv logs/*.log > SHA256SUMS
> echo extra >> logs/error.log
> sha256sum --quiet -c SHA256SUMS

outputexit 1

logs/error.log: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match

--quiet suppresses the OK lines, so in a long list only the failures show up.

Use the result in a script

$ sha256sum todo.txt > todo.sha256
> if sha256sum --status -c todo.sha256; then echo "todo.txt is intact"; fi

output

todo.txt is intact

--status prints nothing at all; the exit status alone says whether every file matched.

Check a download against a published hash

$ expected=328f70102b0d08bbdea3cbb5b0e70339167d51a8260a023be34668b70f303ffe
> echo "$expected  todo.txt" | sha256sum -c

output

todo.txt: OK

When a website lists only the hash, build a one-line checklist yourself: the hash, two spaces, the file name, piped into sha256sum -c. This beats comparing 64 characters by eye.

Hash a string, not a file

$ printf 'hello' | sha256sum
> echo 'hello' | sha256sum

output

2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824  -
5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03  -

With no file, sha256sum reads standard input and shows - as the name. The two hashes differ completely because echo adds a newline: always use printf when hashing a value.

Just the hash

$ sha256sum < todo.txt | cut -d ' ' -f 1

explain

output

328f70102b0d08bbdea3cbb5b0e70339167d51a8260a023be34668b70f303ffe

Cutting the first field gives the bare digest for a variable or a comparison.

BSD-style output

$ sha256sum --tag todo.txt

explain

output

SHA256 (todo.txt) = 328f70102b0d08bbdea3cbb5b0e70339167d51a8260a023be34668b70f303ffe

--tag prints SHA256 (name) = hash, the format used by BSD and macOS tools. sha256sum -c understands both formats.

Ignore files that are not present

$ sha256sum todo.txt notes.txt > SHA256SUMS
> rm notes.txt
> sha256sum -c --ignore-missing SHA256SUMS

output

todo.txt: OK

--ignore-missing skips entries whose files don't exist, which is useful when a published list covers many files and you downloaded only one.

Common pitfalls

The standard checklist format is the hash, two spaces (or a space and *) and the name. Recent GNU versions also accept a single space, but older ones and other tools may not, so write two.
echo value | sha256sum hashes the trailing newline too. Use printf '%s' value.
File names in a checksum list are relative to where sha256sum was run. Run -c from the same directory, or the files will be reported as missing.
A file name containing a backslash or newline is written with a leading \ and escaped characters. Such lines are correct; don't strip the backslash when parsing.

GNU vs BSD and macOS

The examples above ran the GNU/Linux version. These are the differences that matter on macOS and the BSDs (written from their documentation, not run here).

macOS has traditionally offered shasum -a 256 file instead, which prints the same format and supports -c. The BSDs have sha256, which prints the BSD style that --tag imitates.

Options worth knowing

A selection, described in our own words. For the full list, see sha256sum(1) or sha256sum --help.

Option	What it does
`-c, --check`	Read checksums from FILE and verify the listed files.
`--quiet`	With -c, don't print OK for files that match.
`--status`	With -c, print nothing; report only through the exit status.
`--ignore-missing`	With -c, skip files that do not exist.
`-w, --warn`	With -c, warn about improperly formatted checksum lines.
`--strict`	With -c, exit non-zero for improperly formatted lines.
`--tag`	Print BSD-style lines: SHA256 (file) = hash.
`-b, --binary`	Read in binary mode and mark names with *; no difference on Linux.
`-t, --text`	Read in text mode (the default); no difference on Linux.
`-z, --zero`	End each output line with NUL instead of newline, and do not escape names.

Examples

Common pitfalls

GNU vs BSD and macOS

Options worth knowing

Related