Before blaming Rufus, blame arithmetic. A Windows ISO with even one damaged byte is a broken installer waiting to fail at the worst moment - and a single SHA-256 comparison against Microsoft's published value tells you the truth in about a minute.
Professional technicians check the hash of every installer image they did not create themselves. It is not paranoia; it is the cheapest diagnostic in this entire series - one check that rules out the single most common cause of Rufus failures before you waste a write cycle finding out the hard way.
A Windows ISO is a download of 5 to 6 GB. Browser pauses, sleepy laptops, a Wi-Fi drop at 97 percent - any of these can leave you with a file that is almost complete and completely unusable. Rufus then gets blamed for extraction failures that were decided during the download. A checksum check takes under a minute on most PCs and answers the only question that matters: is this file bit-for-bit the file Microsoft published?
You do not even need a separate tool. Select the ISO in Rufus and click the tick (✓) button beside SELECT - its tooltip reads 'Compute image checksums'. Rufus shows MD5, SHA-1 and SHA-256 values for the file. Compare the SHA-256 line with the value Microsoft lists for that exact language edition on its ISO download page. They must match completely - a near match is a mismatch.
Two copy-paste routes, both built into Windows. PowerShell first:
Change the path to your file's real location. The Command Prompt alternative does the same job:
Compare the result character by character with Microsoft's published hash for your edition and language.
Only one source counts: Microsoft's own download page, which prints the SHA-256 values for its Windows ISOs next to the download links, per language. A hash copied from a forum post, a video description or a random blog is not a reference - it could belong to a different edition, a different language, or a file you should not be running at all.
There is no repair for a wrong hash, because nobody knows which bytes are wrong. Delete the file and download again on a stable connection, with the PC awake and enough free disk space. If big browser downloads keep failing on your connection, use Microsoft's Media Creation Tool instead - it downloads and verifies as part of its own process. Then check the new file's hash before Rufus ever sees it.
Watch the video for the full flow - a verified ISO going into Rufus and coming out as a working installer.
▶️ Watch Full VideoThen your ISO is proven good and suspicion moves to the drive and the write: run Rufus's bad blocks check on the USB, try a different port, and make sure you are on a current Rufus from rufus.ie. The checksum's job was to remove one suspect completely - and it has.
SHA-256. It is the value Microsoft publishes for current Windows ISOs and the stronger algorithm. Rufus computes several hashes at once; use the SHA-256 line and ignore the shorter ones for this purpose.
Rufus's download option fetches from Microsoft's servers, which makes corruption unlikely - but unlikely is not impossible, and the check costs a minute. For any ISO that arrived by any other route, treat the check as compulsory, not optional.