A hash is a fingerprint for a file. If your ISO's SHA256 matches the fingerprint the maker published, the file is bit-for-bit genuine. If it does not match, nothing else about the file can be trusted. Windows already has the tool built in.
Every ISO guide skips this step, and it is the only step that actually proves anything. Antivirus scans guess; a hash comparison knows. One changed byte anywhere in a multi-gigabyte image produces a completely different fingerprint, so a poisoned or corrupted ISO cannot hide. Here is the complete check, using a tool that ships inside Windows itself.
👆 The command and its answer. The hash above is shortened as an example — your real one is 64 characters long.
The check needs two fingerprints: your file's, and the maker's. Linux distros make this easy — a file named SHA256SUMS (or checksums) sits beside the download on the release page. Download it from the same official page, find your exact ISO's name inside, and keep its hash ready.
Honest note: Microsoft does not always print a hash beside the download button, though it publishes hashes through its download details and subscription channels. Where no official hash exists for a file, this check cannot help — which is precisely why the source rule in the core guide matters so much.
certutil -hashfile Win11.iso SHA256 — replace the name with your exact file name — and press EnterCompare the first four and last four characters first — a mismatch often shows up immediately. If those agree, compare the full string in blocks of eight or so characters. Pasting both hashes into a document, one above the other, makes differences easy to spot. One single different character means the whole check has failed — hashes do not do almost.
If you prefer PowerShell, Get-FileHash .\Win11.iso prints the SHA256 by default, ready for the same comparison. Use whichever shell you have open; the fingerprint is identical.
A failed check has only three possible meanings: the download was interrupted or corrupted (the most common), you hashed the wrong file, or the image was deliberately modified. The correct response is the same in all three cases:
Never install a failed ISO anyway to see what happens — installation is exactly the moment a modified image is most dangerous.
Where every ISO comes from, shown in the video — and this page gives you the two-minute proof for whichever file you bring home.
▶️ Watch Full VideoMD5 is an older, weaker fingerprint that attackers can sometimes forge. SHA256 is the current standard and is what makers publish. If a site offers only an MD5 for a Windows image, that alone is a warning sign.
It proves the file is exactly the file the maker released — nothing added, nothing changed since it left their server. That is the strongest guarantee available for a downloaded file, and it is why the hash must come from the maker's own page, not from the site that gave you the ISO.
You are in the wrong folder, or the file name is typed differently. Open the folder that holds the ISO first, then open Command Prompt from inside it, and copy the exact file name including the .iso ending.