TNGP-0002 – Verifying Downloaded Content Using SHA1 and MD5
Created: Mar 22, 2016Â |Â Updated: July 06, 2020
INTRODUCTION
Verifying downloaded content by comparing MD5 or SHA1 hash values is a good exercise in caution when receiving files from the internet. Doing so informs whether or not you have downloaded a legitimate file from the developer. File tampering is unlikely to happen and we’d like to think it would never happen to us, but the reality is, no one who uses the internet is immune to being a victim to it. The best we can do is offer safeguards for prevention.
To ensure that you are receiving the correct file and that the file’s integrity has been maintained, you can follow the steps below. It isn’t necessary to check both the MD5 or SHA1 hash values, but feel free to give yourself a little extra peace of mind.
HOW TO VERIFY SHA1
- Open Terminal (located in /Applications/Utilities).
- Type the following at the Terminal prompt: openssl sha1 [full path to file]
Example:
Terminal Command:
openssl sha1 /Users/yourname/Downloads/CS4_Download.dmg
Result:
SHA1(/Users/yourname/Downloads/CS4_Download.dmg)= 1eda5916a7fa8cefe8ab78e3662a1c7aceaa4cfa
Tip: Instead of typing a path to a file, you can drag the file to the Terminal window, e.g. type “sha1 ” and then simply drag and drop the DMG file to the Terminal window.
- Now compare the result above to what’s posted on our website for the particular file you’re downloading.
- If they are the same, you know the file you downloaded is the correct file, not one that’s been tampered with.
HOW TO VERIFY MD5
http://osxdaily.com/2009/10/13/check-md5-hash-on-your-mac/
- Open Terminal (located in /Applications/Utilities).
- Type the following at the Terminal prompt: md5 [full path to file]
Example:
Terminal Command:
md5 /Users/yourname/Downloads/CS4_Download.dmg
Result:
MD5 (/Users/yourname/Downloads/CS4_Download.dmg) = 7bdee043be466f99bf6e1139d89aa2d1
Tip: Instead of typing a path to a file, you can drag the file to the Terminal window, e.g. type “md5 ” and then simply drag and drop the DMG file to the Terminal window.
- Now compare the result above to what’s posted on our website for the particular file you’re downloading.
- If they are the same, you know the file you downloaded is the correct file, not one that’s been tampered with.
Confused by any of this? Are your SHA1 and/or MD5 values different than what’s shown on our website? Just drop us a line at support@econtechnologies.com. We’ll be happy to help!
REVISION HISTORY
March-22-2016 – Created.