You want a file, you grabbed it, and now you are staring at the download icon wondering if you just invited trouble. The fastest way to check is to compare the file’s SHA-256 checksum against the publisher’s official value, and then submit the file or that same hash to a multi-engine scanner like VirusTotal. Do both before you double-click, and you will catch the vast majority of problems without paying a cent or making an account.
Checksum Verification: The Free Built-In Way
Every major operating system can compute a file’s SHA-256 checksum for free, right out of the box. On Windows, you open PowerShell and type Get-FileHash -Path "C:\path\to\file" -Algorithm SHA256. On macOS, you use shasum -a 256 /path/to/file. On Linux, sha256sum /path/to/file does the job. No account, no card, no installation, no country restrictions. This is a local operating-system feature, not a paid service.
What you are doing is comparing the exact bytes of the file you downloaded against the checksum the publisher posted on their official site. If the two hashes match, the file is byte-for-byte identical to what the publisher released. If they do not match, the file has been altered, corrupted during download, or replaced by something malicious. That mismatch is your cue to delete the file and go back to the official source.
Where this fails is when the publisher does not post a checksum, or when you downloaded the file from a mirror that also hosts the checksum. In that case, the checksum only tells you the mirror did not corrupt the file; it does not tell you the mirror is trustworthy. So use checksums when the official site provides them, but do not treat a matching hash as proof of safety if the hash came from the same untrusted place as the file.
VirusTotal: Many Scanners, One Upload
VirusTotal is the go-to free service for checking a file or a hash against dozens of antivirus engines at once. You upload the file, or paste the SHA-256 hash, and it returns a report showing how many engines flag it as malicious. The free public service supports both file scanning and checksum lookups. A user registration key is mentioned in the documentation for API access, but the public website itself does not require a card, and the page does not document any country restrictions.
Here is the catch: a clean VirusTotal result does not guarantee the file is safe. It only means none of the engines that scanned it recognized it as malware. A brand-new or heavily obfuscated piece of malware can slip past all of them. Conversely, a false positive can flag a legitimate file. So use VirusTotal as a strong signal, not a final verdict. If you have the hash, use the hash lookup instead of uploading the file; it is faster and does not upload the actual bytes to a third party.
For most people, VirusTotal is the single most useful free check. It requires no account for the basic web upload, no card, and it works from any browser in any country as far as the documentation shows. If you only do one check, do this one.
MetaDefender Cloud: Another Multi-Engine Option
MetaDefender Cloud offers a similar service: upload a file, URL, IP, or hash, and it runs the scan through multiple engines. The page advertises a free file-scan service, and it does not document any account or card requirement for that free tier, nor any country availability limits. It is a solid alternative if VirusTotal is down, or if you want a second opinion from a different set of engines.
MetaDefender is not better than VirusTotal; it is just different. The free tier has limits on file size and the number of scans per day, but for checking a single download, it works fine. Use it as a backup, not a primary. If VirusTotal says clean and MetaDefender says clean, you are probably fine. If one says malicious, trust the malicious result and delete the file.
What a Browser Warning Does and Does Not Tell You
When your browser or operating system flashes a warning like “This file may harm your computer” or “Windows protected your PC,” that is a signal to stop and inspect, not a verdict. The warning only means the browser or the site detected something suspicious, an unknown publisher, a download from a flagged domain, or a missing signature. It does not prove the file is malware, and it does not prove the file is safe to run.
Conversely, the absence of a warning does not mean the file is clean. A browser warning is a heuristic, not a full scan. It catches known bad domains and files with bad reputations, but it cannot catch everything. So treat the warning as a prompt to do the checks above: compute the checksum, check it against the official value, and submit the file or hash to VirusTotal or MetaDefender. If the warning appears and the checksum does not match, delete the file immediately.
Also check the publisher signature. On Windows, right-click the file, go to Properties, and look at the Digital Signatures tab. A legitimate file from a known company will have a valid signature from that company. An unknown or invalid signature is a red flag, even if the checksum matches. On macOS, right-click the file and select Open to bypass the Gatekeeper warning only if you are certain of the source; otherwise, delete it.
What to Check Before You Commit to a Download
Before you even download a file, check the source. Is it the official website of the software publisher, or a random mirror? Official sites are the only place you should trust for checksums and signatures. If you are downloading from a third-party site, assume it is untrusted until proven otherwise. A checksum from the official site is the only one that matters.
Check the file extension. A file named setup.exe is an executable; a file named document.pdf.exe is also an executable, just disguised. Show file extensions in your operating system settings so you can see the real type. If the file is supposed to be a PDF but the extension says .exe, delete it.
Check the file size. If you are downloading a 100 MB program and the file is 2 MB, something is wrong. Corrupted downloads happen, but a dramatically smaller file usually means you got a stub or a trojan instead of the real thing. Compare the size against the official site if you can.
Finally, check the URL. Look for https:// and a domain that matches the publisher’s name. A site like microsft.com instead of microsoft.com is a phishing attempt. If the URL looks wrong, close the tab and go to the official site directly by typing the address yourself.
Frequently Asked Questions
Can I check a file without uploading it to a website?
Yes. Compute the SHA-256 checksum locally using the built-in tools on Windows, macOS, or Linux, and compare it to the publisher’s official checksum. This does not upload anything and works offline. It only verifies integrity, not malware, so pair it with a multi-engine scan for full coverage.
What if the publisher does not provide a checksum?
Then you cannot verify integrity that way. Skip the checksum and go straight to VirusTotal or MetaDefender with the file or its hash. If those come back clean, the file is probably fine, but you are trusting the scanners and the source. If the source is a third-party mirror, consider finding the official site instead.
Is a clean VirusTotal result enough to trust the file?
No. A clean result means none of the engines flagged it, but a new or obfuscated piece of malware can evade all of them. Always combine the scan with a checksum check against the official value, and verify the publisher signature if the file has one. If anything is off, do not run the file.
What should I do if the checksum matches but the browser warning appears?
Trust the checksum over the warning, but do not ignore the warning entirely. The warning may be a false positive from an unknown publisher or a recently signed certificate. Check the publisher signature, verify the source URL, and if everything looks right, you can proceed. If the warning persists and the file is from a well-known publisher, it is likely a false positive.
Can I use these methods on a phone or tablet?
Checksum tools are available for Android and iOS, but they are not built in. You would need to install an app, which itself could be malicious. For most phone downloads, the safest route is to use the official app store and skip sideloading entirely. If you must sideload, use a desktop computer to run the checks and scans before transferring the file.
More on software
This is one of the guides in Where to Download Software Safely. The others:
