You downloaded a file, and the site lists an MD5 (or SHA-256) checksum next to the download link. Checking it takes under a minute and confirms two things: the download was not corrupted in transit, and the file is byte-for-byte the one the publisher posted. Windows has two built-in ways to do it, and there is a third way that needs no terminal at all.

How do you check an MD5 checksum on Windows?

  1. Open Command Prompt (press Start, type cmd, Enter).
  2. Run: certutil -hashfile "C:\path\to\your-file.zip" MD5
  3. Compare the printed value with the checksum on the download page. If every character matches, the file is intact.

There is no separate md5sum command on Windows; certutil is the built-in equivalent.

Method 1: certutil in Command Prompt

certutil ships with every Windows version since Vista, so nothing needs to be installed.

  1. Press Start, type cmd, press Enter.
  2. Type certutil -hashfile , then drag the file from Explorer into the window: Windows pastes the full quoted path for you.
  3. Add the algorithm at the end and press Enter:
certutil -hashfile "C:\Downloads\installer.exe" MD5

The hash prints as one line of hex characters. The same command handles other algorithms, which matters because most modern projects publish SHA-256 instead of MD5:

certutil -hashfile "C:\Downloads\installer.exe" SHA256
certutil -hashfile "C:\Downloads\installer.exe" SHA1

Compare the output with the published value. Case does not matter; every character does. A single differing character means a different file.

Method 2: Get-FileHash in PowerShell

PowerShell's Get-FileHash does the same job with a cleaner output format:

Get-FileHash "C:\Downloads\installer.exe" -Algorithm MD5

Without the -Algorithm switch it defaults to SHA-256. To compare automatically instead of by eye, let PowerShell do the equality check:

(Get-FileHash "C:\Downloads\installer.exe" -Algorithm MD5).Hash -eq "PASTE_EXPECTED_HASH_HERE"

It prints True when the file matches and False when it does not. This is the safest way to compare long SHA-256 values, where a by-eye comparison is easy to get wrong.

Method 3: no terminal, in the browser

If you check hashes rarely, a terminal command you have to look up each time is friction. A browser-based checker does the same computation locally: the local file hash checker computes MD5, SHA-256, SHA-512, SHA-1, and CRC32 for a file you pick, and if you paste the published checksum it tells you directly whether it matches.

The file is hashed on your own device and never uploaded, which is the property that makes this safe for installers and private documents alike. For downloads that publish a CRC32 value instead (common for ROMs, archives, and firmware), the CRC32 checksum tool covers that variant.

What does a matching checksum actually prove?

If the hashes match: the file on your disk is byte-for-byte identical to the one the publisher hashed. The download was not truncated or corrupted, and nothing modified it on the way.

If the hashes differ: the usual cause is an incomplete download, so re-download first. If it still differs, you may have a mirror serving a different build, or a genuinely tampered file; get the checksum and the file from the publisher's own page and compare again.

One honest caveat: MD5 is fine for detecting corruption, but it is not tamper-proof, since collisions can be manufactured. When a site publishes both MD5 and SHA-256, compare the SHA-256. It proves the same integrity with none of MD5's weaknesses.

Why is there no md5sum on Windows?

md5sum is a Linux and macOS utility, and Windows never shipped it. Searches for "md5sum for windows" usually end at third-party downloads, which is backwards: installing an unverified tool to verify a download adds risk instead of removing it. certutil and Get-FileHash are already on your system and cover MD5, SHA-1, SHA-256, and SHA-512. The only common algorithm they skip is CRC32, which the browser tool above handles.

Check the file without installing anything.

The Cleanor local file hash checker computes MD5, SHA-256, SHA-512, SHA-1, and CRC32 in your browser and compares the result with the published checksum for you. The file never leaves your device, there is no account, and the whole check takes a few seconds.