To check the sha1 of a file I would use openssl sha1 <file> I'm not sure what to use to check the sha256 hash of the file however, what would you recommend?

4 Answers 4


You can use

openssl dgst -sha256 <file>

Tested on LibreSSL 2.6.4 on macOS 10.14 (Mojave).

Prior to Mojave you can use openssl sha -sha256 <file> or openssl sha256 <file>.

To check command line options for the openssl sha command: openssl sha -help.

  • 1
    This is also portable and runs on ubuntu. Nov 8, 2017 at 20:57
  • You may need to use /usr/bin/openssl explicitly Oct 17, 2020 at 0:15
  • 1
    "Prior to Mojave" - openssl sha256 <file> still works, on MacOS Catalina, as of Nov. 2020.
    – flow2k
    Nov 21, 2020 at 23:56

OS X ships with a shasum command.

> which shasum

You can use:

> shasum -a 256 <file>

More details:

> shasum --help
Usage: shasum [OPTION]... [FILE]...
Print or check SHA checksums.
With no FILE, or when FILE is -, read standard input.

  -a, --algorithm   1 (default), 224, 256, 384, 512, 512224, 512256
  -b, --binary      read in binary mode
  -c, --check       read SHA sums from the FILEs and check them
  -t, --text        read in text mode (default)
  -p, --portable    read in portable mode
                        produces same digest on Windows/Unix/Mac
  -0, --01          read in BITS mode
                        ASCII '0' interpreted as 0-bit,
                        ASCII '1' interpreted as 1-bit,
                        all other characters ignored

The following two options are useful only when verifying checksums:
  -s, --status      don't output anything, status code shows success
  -w, --warn        warn about improperly formatted checksum lines

  -h, --help        display this help and exit
  -v, --version     output version information and exit

When verifying SHA-512/224 or SHA-512/256 checksums, indicate the
algorithm explicitly using the -a option, e.g.

  shasum -a 512224 -c checksumfile

The sums are computed as described in FIPS-180-4.  When checking, the
input should be a former output of this program.  The default mode is to
print a line with checksum, a character indicating type (`*' for binary,
` ' for text, `?' for portable, `^' for BITS), and name for each FILE.

Report shasum bugs to [email protected]
  • Hmm I don't seem to have it on osx 10.11.3. which shashum outputs nothing
    – erikvold
    Mar 14, 2016 at 17:24
  • 4
    @erikvold You know what? I bet I got with the Xcode Command Line tools. Argh. I really wish Apple wouldn't pollute /usr/bin with optional stuff. I'll have to verify this is the case later today. Will update answer if it indeed came from the XCL install.
    – Ian C.
    Mar 14, 2016 at 19:41
  • 2
    shasum returns a different hash than openssl sha -sha256 <file>(with the latter being the correct hash). Any idea why?
    – ws6079
    Jul 21, 2017 at 18:02
  • 1
    @ws6079 shasum is a perl script, uses Digest::SHA to compute the hash value. For the same file I get the exact same SHA using either shasum or openssl for a SHA-256 hash computation. See: gist.github.com/ianchesal/82a064b8971eb5e717ce84f3ded6dbfd
    – Ian C.
    Jul 22, 2017 at 7:21
  • shahsum is working great for me today.
    – nycynik
    Apr 1, 2019 at 17:37

To clarify @John's useful answer - which allows you to compare a given hash with its file in one command:

Enter shasum -a 256 -c <<<,
followed by an optional space,
followed by a single tick ('),
followed by the hash to compare,
followed by a space,
followed by a mode character, based on how the initial hash was generated:

  • nothing, if the hash was created with -t or no option (text mode, which is the default)

  • asterisk (*), if the hash was created with -b (binary mode)

  • question mark (?), if the hash was created with -p (portable mode)

  • caret (^), if the hash was created with -0 (bits mode)

followed by the path to the file,
followed by a closing single tick (').

Like the following breakdown, with delineating parens around the hash and filepath parts, and square brackets around the optional "mode character" part. (Don't include the parens or brackets in real life - they're just here to make the parts easy to see!)

shasum -a 256 -c <<< '(hashToCompare) [mode character](filepath)'

Broken down:

The actual shasum command is shasum -a 256 -c

  • -a 256 tells shasum to use sha256.

  • -c tells shasum to "check" the provided input.

The <<< is a Unix/Linux special character set, called a "redirection" operator. It's for feeding something into a prior command. By using it, we're saying we're going to provide a string of information for the shasum command to use as input.

The string of input information must have opening and closing single ticks, such as 'some string here', or in this case, the hash, mode character, and filepath to be checked.

  • The hash part inside the string doesn't need anything special - but it must be followed by a space.

  • The mode character part can be nothing, an asterisk (*), a question mark (?), or a caret (^). This tells shasum the mode with which the hash was generated. (Note: no character at all, representing text mode, is shasum's default.)

  • The filepath part, is the actual path to the file to be checked.

So, here's a real-life example checking a particular MAMP download file against it's purported SHA-256 value. The * mode character was required for this check to work:

shasum -a 256 -c <<< 'f05ede012b8a5d0e7c9cf17fee0fa1eb5cd8131f3c703ed14ea347f25be11a28 *MAMP_MAMP_PRO_5.2.pkg'

Note: the result of this command (for my example file) is either -





shasum: WARNING: 1 computed checksum did NOT match

Update: I recently had to do something similar, but with a file containing the hash value/filename string. Here is an alternative for that situation:

cat <text-file-containing-string> | shasum -a <shasum-value> -c

For example:

cat qemu-w64-setup-20230822.sha512 | shasum -a 512 -c
  • For me this works without the asterisk before the filename (as well as with the asterisk).
    – Peter W
    Mar 5, 2019 at 10:35
  • shasum -c <<< '7cb77378a0749f2a9b7e09ea62ffb13febf3759f *sample.txt' returns the message *sample.txt: FAILED open or read. Without the asterisk, sample.txt: OK. I haven't been able to find the basis of the asterisk's use elsewhere yet. Could you clarify?
    – SoFarther
    Jul 24, 2019 at 4:57
  • Does the presence of the asterisk indicate that the checksum used as input in the example was generated in binary mode ( with --binary option)? From the man page: "When checking, the input should be a former output of this program. The default mode is to print a line with checksum, a character indicating type (* for binary, ` ` for text, U for UNIVERSAL, ^ for BITS,? for portable), and name for each FILE." So, the characters between the checksum and filename depend on the mode set when the checksum was created?
    – SoFarther
    Jul 24, 2019 at 5:13
  • @SoFarther: yes, you're right. After some experimentation to prove that idea, I have updated my post to clarify the "mode" aspect.
    – leanne
    Jul 24, 2019 at 15:01
  • 1
    So clarify, whether you need an asterisk (or mode character other than default) correlates to the file. Text files can omit the character because the default mode is text. Leaving it out for an ISO will error "shasum: standard input: no properly formatted SHA checksum lines found". Binary file, so the asterisk (binary mode) will be needed.
    – lodeOfCode
    Nov 9, 2021 at 23:32

I would use this command.

shasum -a 256 -c <<<'_paste hash to compare here_ *_path to file goes here_'


shasum -a 256 -c <<< '0d2ea6de4f2cbd960abb6a6e020bf6637423c07242512596691960fcfae67206 */Users/USERNAME/Downloads/someprogram.dmg'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .