Most people skip this step and most installs still work - until one does not, in a way nobody can diagnose. The checksum check is the cheapest insurance in the whole install process.
The Mint team publishes a fingerprint for every ISO. If the fingerprint of your downloaded file matches it exactly, the file is bit-for-bit what they released. Here is the check on both systems, in copy-paste form.
A checksum is a fingerprint of the file, published by the Mint team next to the download. Two things can make your copy differ from the original:
The habit costs two minutes and removes an entire class of mystery failures. Professionals verify every ISO, every time - it is not paranoia, it is routine.
On the Mint download page for your edition, alongside the ISO there are two small text files:
sha256sum.txt - the list of official fingerprints, one per editionsha256sum.txt.gpg - the signature that proves the fingerprint list itself is genuine (advanced check, step 4)Save sha256sum.txt into the same folder as the ISO. Now run the check on whichever system you have.
No extra software is needed - Windows has a built-in tool. Open the folder holding the ISO, click in the address bar of File Explorer, type cmd and press Enter so the prompt opens in that folder. Then run:
CertUtil -hashfile linuxmint-22.3-cinnamon-64bit.iso SHA256
Windows prints the fingerprint of your file. Compare it with the line for your edition inside sha256sum.txt. Every character must match. If even one differs, the file is not the file Mint published - delete it and download again, ideally from a different mirror.
On any Linux system, in the folder with both files:
sha256sum linuxmint-22.3-cinnamon-64bit.iso
Compare the output with sha256sum.txt the same way. For the full professional check, also verify that the fingerprint list itself is signed by the Linux Mint team. Import their signing key and check the signature:
gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-key "27DE B156 44C6 B3CF 3BD7 D291 300F 846B A25B AE09"
gpg --verify sha256sum.txt.gpg sha256sum.txt
A "Good signature" result for the Mint key means the fingerprints are the team's own. This second layer is optional for home use - but it is exactly what the first layer alone cannot prove.
Watch the video for the download and mirror steps - then run this two-minute check before you write the USB.
▶️ Watch Full VideoAlmost certainly not - the common cause is an incomplete or corrupted download, especially over unstable Wi-Fi. Delete the ISO, download again from the official site (a different mirror helps), and re-check. Only worry if downloads from the official site repeatedly mismatch.
That is exactly what the signed companion file sha256sum.txt.gpg is for. Verifying it with GPG against the Linux Mint signing key proves the fingerprint list came from the Mint team. The commands are in step 4 of this guide.
It is still worth it. The official site protects against tampering, but nothing protects a 2.9 GB download from a dropped connection except the checksum. Two minutes now can save an afternoon of chasing an installer fault that was really a broken file.