7-Zip / certutil (SHA-256) for Windows is a free way to confirm that a downloaded file has not been altered, and it suits anyone who installs software, wallets or backup tools from the internet. Rather than a single application, this entry covers two Windows-friendly routes to the same job: computing a SHA-256 checksum and comparing it with the value the developer publishes. The certutil command is already part of Windows, while 7-Zip is a widely used file archiver that is available from its official website.
Checksum checks take seconds and cost nothing, which makes them a sensible habit before you run any new file. They do not judge whether a program is trustworthy on their own, but they reliably catch corrupted or swapped downloads. The rest of this page explains how to use the tools, what a hash actually means, and when a mismatch should stop you.
What Is a SHA-256 Checksum?
A SHA-256 checksum is a fixed-length string, 64 hexadecimal characters long, produced by running a file through the SHA-256 hash function. The output is determined entirely by the file's contents. Change one byte, and the resulting string changes completely, which is why it works as a fingerprint.
Publishers usually list this value next to a download, sometimes on the same page and sometimes in a release notes file. Your job is to compute the same value on your own machine and compare the two. If they match, the file you have is identical to the one the publisher hashed.
Checksums are not encryption and do not hide anything. They prove integrity, meaning the file was not changed in transit or on a mirror, but they say nothing about whether the publisher itself is trustworthy. Keeping those two ideas separate helps you read hash results correctly.
Who Needs to Verify Downloads Before Running Them?
Anyone who installs software from the internet can benefit, but some readers gain more than others. People who download wallet clients, backup utilities or trading helpers from project pages often face a choice between several mirrors, and a copy from an unofficial mirror could be altered. A hash check settles the question quickly.
Power users who script installations also rely on hashes. A build pipeline can compare the checksum of every package before deployment, which catches corrupted files on a shared network drive. Even a home user with a large archive benefits, because a damaged file might only show up months later.
Beginners do not need to memorize commands. The main habit is simple: check the published value when one exists, and treat a missing value as a reason to look for another source rather than as a green light.
Practical Situations for Checking File Hashes
Consider a few situations in which a checksum comparison earns its minute of effort. Suppose you need a portable recovery tool and find two download links. Hashing both installers and comparing the results to the publisher's value tells you which copy to keep.
Another case is a large backup archive copied to an external drive. Before deleting the original, hash the copy. If the value matches the original's, you know the copy is complete. This is especially useful after a long transfer over an unstable connection.
Finally, consider software you received from a colleague or friend. You can compare its hash against the official release for the same version. If the hash does not match, the file may have been modified, and you should not run it until you have confirmed where it came from.
Key features
SHA-256 checksum comparison
How to install 7-Zip / certutil (SHA-256) on Windows
- 1
Download 7-Zip from the official website
Open 7-zip.org and choose the Windows download. Download only from the official website, then run the installer and accept the default settings unless you have a specific reason to change them.
- 2
Confirm certutil is available
certutil ships with Windows, so there is nothing separate to install. To check, open Command Prompt and type certutil -? to display its help screen.
-
Prepare the expected hash
Copy the SHA-256 value from the publisher's page or release notes before you start, so you have something concrete to compare against.
System requirements
- A Windows PC, since certutil is part of the operating system
How to use 7-Zip / certutil (SHA-256)
Verifying a file takes about a minute once you have the expected hash in hand. Keep the downloaded file and the publisher's SHA-256 value ready before you begin.
- Open the folder that contains the downloaded file in File Explorer.
- Click the address bar, type cmd and press Enter so Command Prompt opens in that folder.
- Type certutil -hashfile followed by the exact file name and SHA256, then press Enter. Wrap the name in double quotes if it contains spaces.
- Read the hexadecimal string printed on the second line of the output.
- Compare it with the published value character by character, or paste both into a text editor and search for the match.
- If the strings match, the file is identical to the one the publisher hashed. If they differ, delete the file and download it again before comparing once more.
Pros & cons
- Free to use
- certutil is included with Windows, so no extra download is needed for hashing
- Works on any file type, not only installers
- Verification takes seconds once you have the expected value
- certutil runs from the command line, which may feel unfamiliar to some users
- A matching hash proves integrity, not that the publisher can be trusted
- 7-Zip's main job is archiving, so its checksum features are secondary
- You must locate a trustworthy published hash yourself
Is 7-Zip / certutil (SHA-256) safe?
Start with the source. Get 7-Zip only from the official site at 7-zip.org, and avoid repackaged copies on third-party download portals. Take the published SHA-256 value from the same official page as the file, not from a mirror that might be altered alongside it.
Verify the installer's SHA-256 checksum or signature before you run it. Remember that a hash proves integrity, not intent: if an attacker controls both the file and the posted value, the check will still pass. Where the publisher offers a digital signature, treat it as the stronger signal. This tool never asks for a seed phrase, so leave any site that requests one. Finally, check the latest version on the official website before installing.
- Official source only. Download from www.7-zip.org. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Compared with Gpg4win, which checks PGP signatures on wallet installers, this approach answers a narrower question. A hash tells you that a file matches a known value, while a signature ties the file to a publisher's key, so the two are complementary rather than interchangeable. Where Gpg4win asks you to trust a key, certutil asks you to trust a value you copied from somewhere, which makes the source of that value important. VeraCrypt and Cryptomator are not checksum tools; they protect data with encryption, so a checksum can confirm that a backup copy is intact but cannot hide its contents. Choose certutil for a quick integrity check, and reach for signature-based tools when you need to confirm who released the software.
Specifications
- Price
- Free
- Type
- Proprietary
- License
- —
- Latest version
- —
- Last update
- —
- Windows support
- Yes (official Windows version)
- Official site
- www.7-zip.org
Frequently asked questions
Yes, both routes are free. 7-Zip is available at no cost from its official website, and certutil comes with Windows at no extra charge. You do not need a license or subscription to compare SHA-256 values as often as you like. If you have questions about the download itself, the official site is the right place to check.
The safest route is the official website, 7-zip.org. Copies on unofficial download sites may have been altered, which is why a hash check matters. Compare the installer's SHA-256 value with any published value before running it. A match means the file has not changed since it was hashed, though it does not confirm the publisher's intent on its own.
No. certutil is a command-line tool built into Windows, so it is available on a standard installation. Open Command Prompt and run certutil -? to see its help screen. You do not need to download or update anything extra to use it for hashing. If the command is not recognized, a system file check is a sensible next step.
It tells you whether a file is identical to the one that was hashed. Any change to the file, even a single byte, produces a different string. It does not tell you whether the file is safe or whether the publisher is honest. Treat it as one step in checking a download, alongside the source and, when offered, a digital signature.
Do not run the file. A mismatch usually means the download was corrupted in transit or the file was changed after the hash was published. Delete the copy, download it again from the official source, and compare the new value. If it still differs, check that you copied the expected hash correctly before drawing any conclusion about the file.
Yes. certutil supports several algorithms, including MD5, SHA1, SHA256, SHA384 and SHA512, which you specify at the end of the command. Use the algorithm the publisher lists, because a value computed with a different algorithm will never match. SHA-256 is a common choice for software downloads, so it is the one most readers will need.
Verdict
7-Zip / certutil (SHA-256) for Windows suits anyone who wants a free, no-frills way to confirm that a downloaded file matches the publisher's value. It costs nothing, needs no extra installation thanks to certutil, and works on almost any file. It is not a full security suite, and it will not tell you on its own whether a program is malicious. Pair it with a trusted source and, where available, a signature check for the strongest result.