Verifying an ISO before installing it: why and how

You have just downloaded an ISO of several gigabytes. Before copying it to a USB drive, a three-minute check can save you a lost evening, or worse.

What verification protects against

A checksum (or hash) is a unique "summary" of your file: if a single bit changes, the checksum changes completely. Comparing it with the one published by the publisher detects two problems:

• a corrupted download (network drop, faulty disk), a frequent cause of installations that crash at 80 %;
• a tampered file, for example on a dubious mirror site that slipped malware into it.

Step 1: download from the official source

Verification is only worth anything if the expected checksum comes from a trustworthy source. Take the ISO and its checksum from the project's website, not from a forum. The official links are gathered here.

Step 2: compute the checksum

On every system, one command is enough:

Get-FileHash .\ubuntu.iso -Algorithm SHA256

That command is for PowerShell on Windows. On macOS use shasum -a 256 ubuntu.iso, and on Linux sha256sum ubuntu.iso.

For a file under 2 GiB, our toolbox tool does the calculation right in your browser, without sending anything online.

Step 3: compare

Both strings must be strictly identical. A difference, even of a single character, means: delete the file and download it again.

Going further: the signature

Some projects also publish a GPG signature of their checksum file. It is stronger: it proves the list itself has not been forged. Each distribution's guides detail the procedure.

Key takeaways

• Always verify an ISO, especially before writing to a disk.
• Compare with the checksum from the official site.
• If in doubt, download again: it costs a few minutes.

Next, see the Linux live USB guide or the one on installing Windows 11.