How to Verify GIMP SHA-256 Checksum

Verifying the SHA-256 checksum of a downloaded GIMP installer ensures the file is authentic, uncorrupted, and free from malicious tampering. This guide walks you through finding the official hash on the GIMP website, generating the SHA-256 hash on your computer using built-in operating system tools, and comparing the two values to guarantee your installation media is safe to use.

Step 1: Retrieve the Official SHA-256 Hash

  1. Navigate to the official GIMP download page where you downloaded the installer.
  2. Locate the link or text labeled SHA-256, Checksum, or file information near the primary download button.
  3. Copy the 64-character alphanumeric string to your clipboard or keep the browser tab open for reference.

Step 2: Compute the Checksum on Your System

Use the native command-line utility for your operating system to calculate the SHA-256 hash of the downloaded installer file.

On Windows

  1. Open the Start menu, search for PowerShell, and launch it.

  2. Run the following command (replace path\to\gimp-setup.exe with your actual file path):

    Get-FileHash -Algorithm SHA256 "C:\Users\YourUsername\Downloads\gimp-setup.exe"

  3. Press Enter to display the generated hash under the Hash column.

On macOS

  1. Open Terminal via Spotlight Search (Command + Space) or through Applications > Utilities.

  2. Run the shasum command followed by the file path:

    shasum -a 256 ~/Downloads/gimp-x.xx.x-x86_64.dmg

  3. Press Return to view the resulting 64-character hash string.

On Linux

  1. Open your distribution's Terminal.

  2. Run the sha256sum command targeting your downloaded installer or package:

    sha256sum ~/Downloads/gimp-x.xx.x.tar.bz2

  3. Press Enter to see the checksum followed by the file name.

Step 3: Compare the Values

  1. Compare the hash generated in your terminal or PowerShell window with the official hash copied from the GIMP website.
  2. Identical Match: If every character matches, the file is authentic, complete, and safe to execute.
  3. Mismatch: If the hashes do not match, the download is either incomplete, corrupted, or compromised. Delete the downloaded file immediately and download it again from the official GIMP source.