I'm on a Windows machine and I want to run a checksum on the MySQL distribution I just got. It looks like there are products to download, an unsupported Microsoft tool, and probably other options. I'm wondering if there is a consensus for the best tool to use. This may be a really easy question, I've just never run a checksum routine before.
20 Answers
The CertUtil is a pre-installed Windows utility, that can be used to generate hash checksums:
CertUtil -hashfile pathToFileToCheck [HashAlgorithm]
HashAlgorithm choices: MD2 MD4 MD5 SHA1 SHA256 SHA384 SHA512
So for example, the following generates an MD5 checksum for the file C:\TEMP\MyDataFile.img:
CertUtil -hashfile C:\TEMP\MyDataFile.img MD5
To get output similar to *Nix systems you can add some PS magic:
$(CertUtil -hashfile C:\TEMP\MyDataFile.img MD5)[1] -replace " ",""
-
1This is a much easier choice than FCIV, given that this is pre-installed .– CJBSCommented Mar 24, 2015 at 19:26
-
1Note: this doesn't come pre-installed on Win XP, but given that that OS is now obsolete, that shouldn't be a problem.– CJBSCommented Mar 26, 2015 at 17:25
-
2@Laisvis - with your explanation, I went from 0 to done in about 2 minutes. I came to this page looking for how to do it. Your answer was simple and perfect.– IcebergCommented Aug 3, 2015 at 19:16
-
2+1 for recommending pre-installed version. What better way to ensure secure software to check security and save additional steps hunting, downloading, installing, and validating. Commented Feb 27, 2016 at 12:48
-
1Can someone please tell me how to check file checksum for using certUtil generated Hash ? command line. Would that be just use the same commandline to generate the Hash on the file (after the file was received on the target machine) ?– rvpalsCommented Jun 13, 2016 at 14:42
I personally use Cygwin, which puts the entire smörgåsbord of Linux utilities at my fingertip --- there's md5sum and all the cryptographic digests supported by OpenSSL. Alternatively, you can also use a Windows distribution of OpenSSL (the "light" version is only a 1 MB installer).
-
3For just checking a checksum Cygwin seems a little heavy. Especially since there are 5KB executable for checking the MD5 Commented Jan 26, 2009 at 2:52
-
3It might be heavy but it is a valid answer, particularly when considering a Unixy program (MySQL) is involved. Commented Jan 26, 2009 at 12:33
-
3For those of us who consider Cygwin an essential tool, it's a perfect answer.– ZenexerCommented Aug 6, 2013 at 6:26
-
8It is worth noting that md5sum also comes with git bash (mingw) Commented Jun 13, 2015 at 17:36
Any MD5 will produce a good checksum to verify the file. Any of the files listed at the bottom of this page will work fine. http://en.wikipedia.org/wiki/Md5sum
-
9This answer is no longer good advice. MD5 is vastly insecure nowadays. Using MD5 to validate downloaded files is not secure.– antiduhCommented Oct 28, 2015 at 20:12
-
23@antiduh Seeing as you get the hash from the same place you download it from, your argument is moot. You're limited by the hash provided by the website.– J.JCommented Mar 1, 2016 at 14:19
-
8Let's note that the user just wants to verify that the downloaded file has not been corrupted. If you take a look at https://en.wikipedia.org/wiki/MD5#Security you will come across this key sentence in the opening paragraph: "Although MD5 was initially designed to be used as a cryptographic hash function, it has been found to suffer from extensive vulnerabilities. It can still be used as a checksum to verify data integrity, but only against unintentional corruption." Commented Jul 6, 2016 at 0:36
-
2@J.J A lot of official websites make you download the actual binary from another domain, so the argument is valid. You can download a modified VLC from a malicious mirror via the official site, which will be detected by a checksum.– HeyCommented Aug 22, 2017 at 10:50
-
4@antiduh I asked not because I'm too lazy to search, but because RTFM is never an appropriate 'answer' on Stackoverflow (which is what your answer implied). Commented May 2, 2018 at 16:24
On Windows : you can use FCIV utility : http://support.microsoft.com/kb/841290
On Unix/Linux : you can use md5sum : http://linux.about.com/library/cmd/blcmdl1_md5sum.htm
-
2FCIV isn't pre-installed. CertUtil is (on newer Windows OSes) - See answer below: stackoverflow.com/a/28922976/3063884– CJBSCommented Mar 26, 2015 at 17:27
-
-
broken, links. Maybe stackoverflow should run bots that check all the threads for broken links, I mean this is the future. Commented Apr 3, 2023 at 14:01
Checksum tabs: http://code.kliu.org/hashcheck/
This has worked great for me on windows for a while now. It allows easy copying and pasting of checksums. It has box to type/paste check sums from webpages and show matches or non matches quite well.
-
2This handy little utility is rather understated here. First I have no relation to the author(s)---I just think it is a great utility! It lets you generate a hash file of your choice from the context menu in Windows Explorer for a single file or a group of files. You can later double-click that hash file to automatically run a hash verification of those files. I use this frequently to generate a hash for large files I want to copy, then copy the hash file with it, and at the destination, double-click to verify they survived intact. Commented May 20, 2015 at 22:02
-
1Excellent solution, but the link is outdated. The safest place to get this software now is github.com/gurnec/HashCheck– asachetCommented Nov 23, 2018 at 16:29
On MySQL.com, MD5s are listed alongside each file that you can download. For instance, MySQL "Windows Essentials" 5.1 is 528c89c37b3a6f0bd34480000a56c372.
You can download md5 (md5.exe), a command line tool that will calculate the MD5 of any file that you have locally. MD5 is just like any other cryptographic hash function, which means that a given array of bytes will always produce the same hash. That means if your downloaded MySQL zip file (or whatever) has the same MD5 as they post on their site, you have the exact same file.
When I worked with Windows, I found handy HashTab 3rd party tool. It shows MD5, SHA-1 check sums in one of file properties tabs. http://implbits.com/products/hashtab/
7-Zip can be used to generate hashes for files, folders of files, and trees of folders of files. 7-Zip is small footprint and a very useful compression utility. http://7-zip.org/
-
While it is true that 7-zip provides hashes for all of the items listed above, it lacks a way to simply copy-paste it's results directly. CertUtil, since it is a CMD program, does provide copy-paste functionality.– JonathinCommented Apr 28, 2018 at 22:55
-
It's also possible to use 7z.exe via the CMD, for example
7z.exe h -scrcSHA256 -- /path/to/your/file.txtproduces a sha256 hash.– ElpyCommented Apr 25, 2019 at 13:36
To calculate md5 of all the files in the current directory in windows 7
for %i in (*) DO CertUtil -hashfile %i MD5
Download fciv.exe directly from http://www.microsoft.com/en-us/download/confirmation.aspx?id=11533
shell> fciv.exe [yourfile]
will give you md5 by default.
You can read up the help file fciv.exe -h
Just to add another option for Windows users, the Get-FileHash PowerShell cmdlet can be used (https://technet.microsoft.com/en-us/library/dn520872.aspx).
Example usage:
Get-FileHash MyImage.iso -Algorithm MD5
If all you're after is just the raw hash then:
(Get-FileHash MyImage.iso -Algorithm MD5).Hash
The Powershell utility Get-FileHash worked perfectly for me.
https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash
Best utility for Windows is HashCheck that is now on GitHub. https://github.com/gurnec/HashCheck/releases/tag/v2.4.0
Install HashCheck. Now right click on the file -> Create verification file. It will create a file.extension.md5 file with MD5 code in it.
Love it.
Note that the above solutions will not tell you if your installation is correct only if your install.exe is correct (you can trust it to produce a correct install.)
You would need MD5 sums for each file/folder to test if the installed code has been messed with after the install completed.
WinMerg is useful to compare two installs (on two different machines perhaps) to see if one has been changed or why one is broken.
for sure the certutil is the best approach but there's a chance to hit windows xp/2003 machine without certutil command.There makecab command can be used which has its own hash algorithm - here the fileinf.bat which will output some info about the file including the checksum.
Hashing is a standalone application that performs MD5, SHA-1 and SHA-2 family. Built upon OpenSSL.
QuickHash an open source tool supporting MD5, SHA1, SHA256, SHA512 and available for the Linux, Windows, and Apple Mac.
In HPUX ( hp UNIX)
Please install the md5sum package on your UNIX machine for example, if there is a file called a.txt
shell > md5sum a.txt
Just use win32 Checksum api. MD5 is native in Win32.
-
2Have an example of the Win32 API that is small enough for an SO answer and suitable for the asker?– SqeakyCommented Feb 21, 2014 at 16:49