To verify a download, compute its SHA-256 hash on your machine and compare it with the value the publisher lists. If every character matches, the file is the one the publisher intended. Use Get-FileHash on Windows, shasum on macOS and sha256sum on Linux.
The three commands
Windows PowerShell:
Get-FileHash .\installer.exe -Algorithm SHA256
macOS Terminal:
shasum -a 256 ~/Downloads/installer.dmg
Linux:
sha256sum installer.AppImage
Each prints a long hexadecimal string. Compare it with the published value. Do not eyeball only the first few characters. Paste both strings into a text editor on adjacent lines, or let a tool compare them.
Use the checksum file when there is one
Safeguard's download page lists a SHA-256 value for each Desktop build and links a SHA256SUMS file for each release. On Linux and macOS you can let the tool do the comparison. Put the file next to your download and run:
sha256sum --check SHA256SUMS --ignore-missing
On macOS use shasum -a 256 --check with the same file. A line ending in OK means a match. The --ignore-missing flag skips entries for files you did not download.
What a mismatch means
Usually the download was cut short or corrupted, so download again, ideally on a stable connection. Less often, the file was changed in transit or on a compromised mirror. Either way the right response is the same: delete the file, fetch it again from the official page, and if the mismatch persists, report it to the publisher instead of running the file.
What a match does not prove
A checksum proves the file equals what the page says. It does not prove the page is honest. If an attacker controls both the download and the page, they can publish a matching hash for a bad file. That is why the checksum should come from a page you reached by typing the address yourself or from a bookmark, not from a search ad or a link in a message.
Signatures are stronger because they bind the file to a publisher key. The Safeguard page states the macOS builds are signed and notarized, and that the Windows builds are not yet code-signed. So for Windows the checksum is doing more of the work, which makes the habit worth keeping.
Make it routine
For a team, put the steps in your onboarding checklist and record the version and hash you approved. When a new version ships, repeat the check instead of assuming. It adds about a minute.
See also the related posts on installing on Windows and on evaluating a native app before installing.
Where Safeguard fits
Safeguard's own download page publishes the hashes described above. For dependency checks, the free scan at gold.safeguard.sh/scan needs no login.
Quick check
Is SHA-256 the same as a digital signature?
No. A hash checks file integrity against a published value. A signature ties the file to a publisher key.
Which hash does the Safeguard page list?
SHA-256 for each build, with a SHA256SUMS file for each release.
Sources
Last reviewed: 19 October 2026.
