---
title: "Verify File Checksums with SSH"
description: "After downloading a file, it's always helpful to validate it to ensure its not corrupt or malicous. You can accomplish this by comparing checksums - md5sum, sha1, sha256, sha512, etc. - against the..."
url: https://www.inmotionhosting.com/support/security/verify-checksums-ssh/
date: 2018-08-28
modified: 2021-11-19
author: "InMotion Hosting Contributor"
categories: ["Security", "SSH and Root Access"]
type: post
lang: en
---

# Verify File Checksums with SSH

After downloading a file, it’s always helpful to validate it to ensure its not corrupt or malicous. You can accomplish this by **comparing checksums** – *md5sum, sha1, sha256, sha512, etc.* – against the original file if its published on the official website. You can use your computer, SSH, and websites such as [VirusTotal.com](https://www.virustotal.com/) to achieve this. Below we’ll demonstrate how to do this using SSH with a **manual download of WordPress 4.9.8**.

**Note**: The higher the number in the algorithm – *sha224, sha384, etc.* – the stronger the authentication process. Also, this along with the larger the file being validated determines the time before validation completes.

**Warning**: Verifying the checksum against the website only checks that it wasn’t corrupted during the download. It doesn’t guarantee the file isn’t malicious. If the website is hacked, the checksum could also be modified to that of the malicious file. If you believe you may have malicious content on your server, please [request a free server scan](/support/amp/submitting-and-checking-on-status-of-tickets/#submit-support-request) and review our [hack recovery guide](/support/website/backup-and-restore/recovering-from-a-hack/).

## Verify Checksum with SSH

1. [Upload the file(s)](/support/website/how-to-upload-files-server/) into the [correct directory](/support/website/where-to-upload-files/).
2. SSH into the cPanel account using the correct steps for your hosting plan – [Shared](/support/server/ssh/shared-reseller-ssh/) or [VPS/Dedicated](/support/server/ssh/how-to-login-ssh/).
3. Type the preferred checksum command and the path to the file – e.g. `md5sum file.jpg` or `sha1sum public_html/file.png`. For example, here’s the *md5sum* and *sha1sum* output for the downloaded [WordPress 4.9.8](https://wordpress.org/download/releases/): [![Screenshot of md5sum and sha1sum for wordpress-4.9.8.tar.gz file in SSH](https://www.inmotionhosting.com/support/images/stories/hashsums/hashsum-1-ssh-md5sum-sha1sum-bigger.png)](https://www.inmotionhosting.com/support/images/stories/hashsums/hashsum-1-ssh-md5sum-sha1sum-bigger.png)
4. Check that the checksum(s) match the original file. Both checksums above match the [md5](https://wordpress.org/wordpress-4.9.8.tar.gz.md5) and [sha1](https://wordpress.org/wordpress-4.9.8.tar.gz.sha1) checksum respectively from [WordPress.org](https://wordpress.org/download/releases/).

If your SSH checksum matches what’s on the official site, congratulations. If not, you may want to try another validation program (e.g. [GtkHash](https://www.inmotionhosting.com/support/security/checksums-gtkhash/)) or method of downloading the original file such as from a reputable location.