How do I verify the checksum or hash of a downloaded file on the command line? If I have downloaded a file from the internet, and the source website has provided a checksum or hash (eg. SHA-256), how do I verify that the hash of the downloaded file matches the hash reported on the site?

For example, I’ve downloaded a file, and the website states that the SHA-256 hash for it is:

d9cd63f187db2daea1371289508c63a7a24c46316f15ac61f030a7d6ea423915


I do know how to create an SHA-256 hash of the downloaded file using:

shasum -a 256 /path/to/downloaded.pkg


However, I don’t want to do a manual, a.k.a. eyeball, check of the hash. Instead I want to compare the two hashes using a command like diff, preferably by executing a single command-line.
When you first calculate the sum of a file, it produces an output consisting of the sum, two spaces, and the name of the file that produced that sum. If you redirect that output to a file, you can later use the "-c" (for "check") option to automatically check every file listed, to see if the sum still matches.

So, create a text file called "checksum.txt" with one line:

d9cd63f187db2daea1371289508c63a7a24c46316f15ac61f030a7d6ea423915  downloaded.pkg


Then run the command:

shasum -a 256 -c checksum.txt


The command will calculate the sha-256 checksum of the file "downloaded.pkg", compare the result with the precomputed value, and tell you if it matched or not.

You might not even have to create the sum file yourself; most of the time, websites that provide checksums will let you download a text file that's already in the proper format.