Check SHA1 Checksum in Mac OS X

Feb 5, 2012 - 6 Comments

Check SHA1 Hash Checksum in Mac OS X

SHA hashing is frequently used with distribution control systems to determine revisions and to check data integrity by detecting file corruption or tampering. For common usage, a SHA checksum provides a string that can be used to verify a file been transferred as intended. If SHA checksums match, the files integrity has been maintained.

Checking SHA1 Hash in Mac OS X

Launch the Terminal, found within the Applications and Utilities folder, and use the following syntax:

shasum /path/to/file

To verify a file named “DownloadedFile.dmg” on the desktop, it would be:

shasum ~/Desktop/DownloadedFile.dmg

This will output something like this:

$ shasum ~/Desktop/CheckMe.zip
ddfdb3a7fc6fc7ca714c9e2930fa685136e90448 CheckMe.zip

That long hexadecimal string is the SHA1 hash.

An easy way to check SHA1 files buried deep in the file system without typing out the full path, is to type the first part of the command then drag and drop the file into the Terminal window. This automatically types the path for you:

shasum (drag and drop file here)

Remember to put a space after “shasum” for this to work properly.

The default for the shasum command is to use SHA1, the most common hash type, but this can be changed with the -a flag if necessary to 224, 256, 384, or 512. Also, though SHA1 is becoming more common than MD5, you can still easily check md5 hash in Mac OS X as well with the md5 command.

Examples of Using SHA1 to Verify Files

A practical use that Mac users may encounter is when downloading software updates directly from Apple, who lists the SHA1 hash of each file offered through their servers at the end of each downloads page. You can see such a string highlighted in the screenshot below. This string allows users to easily verify the integrity of their downloads either from Apple or when the file has been hosted on a third party mirror site.

SHA1 Checksum on Apple Downloads Page

This is also how it was discovered that OS X 10.7.3 had been quietly updated, and several questions about this spawned this post.

Using SHA1 hash strings are also an easy way to verify file transfers from peer to peer networks and to make sure a download has finished, or that a file was not tampered with somewhere along the line. By knowing the origin SHA1 checksum, you can verify your version of the file(s) in question matches, and determine if the file is indeed valid and has arrived as intended.

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: William Pearson in Command Line, Mac OS X, Tips & Tricks

6 Comments

» Comments RSS Feed

  1. about:blank says:

    openssl dgst -sha256 %FILE%

    MESSAGE DIGEST COMMANDS
    md2 MD2 Digest

    md5 MD5 Digest

    mdc2 MDC2 Digest

    rmd160 RMD-160 Digest

    sha SHA Digest

    sha1 SHA-1 Digest

    sha224 SHA-224 Digest

    sha256 SHA-256 Digest

    sha384 SHA-384 Digest

    sha512 SHA-512 Digest

    man openssl

  2. René Dubois says:

    Git uses SHA1 as well

  3. Devy says:

    ymy.be sugguests a better approach: since openssl has all sorts of hash lib built-in, it is considered to be better than the shasum approach, which is a Perl wrapper of some sha calculation lib.

  4. [...] alternative to checking a SHA1 hash with shasum is to use openssl. Yes, the same openssl utility used to encrypt files can be used to verify the [...]

  5. [...] of this example, checking a SHA1 hash is frequently used to verify file or string integrity, which we’ve covered on several [...]

Leave a Reply

 

Shop for Apple & Mac Deals on Amazon.com

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates