94

I'm on a Windows machine and I want to run a checksum on the MySQL distribution I just got. It looks like there are products to download, an unsupported Microsoft tool, and probably other options. I'm wondering if there is a consensus for the best tool to use. This may be a really easy question, I've just never run a checksum routine before.

1

20 Answers 20

271

The CertUtil is a pre-installed Windows utility, that can be used to generate hash checksums:

CertUtil -hashfile pathToFileToCheck [HashAlgorithm]

HashAlgorithm choices: MD2 MD4 MD5 SHA1 SHA256 SHA384 SHA512

So for example, the following generates an MD5 checksum for the file C:\TEMP\MyDataFile.img:

CertUtil -hashfile C:\TEMP\MyDataFile.img MD5

To get output similar to *Nix systems you can add some PS magic:

$(CertUtil -hashfile C:\TEMP\MyDataFile.img MD5)[1] -replace " ",""
10
  • 1
    This is a much easier choice than FCIV, given that this is pre-installed .
    – CJBS
    Commented Mar 24, 2015 at 19:26
  • 1
    Note: this doesn't come pre-installed on Win XP, but given that that OS is now obsolete, that shouldn't be a problem.
    – CJBS
    Commented Mar 26, 2015 at 17:25
  • 2
    @Laisvis - with your explanation, I went from 0 to done in about 2 minutes. I came to this page looking for how to do it. Your answer was simple and perfect.
    – Iceberg
    Commented Aug 3, 2015 at 19:16
  • 2
    +1 for recommending pre-installed version. What better way to ensure secure software to check security and save additional steps hunting, downloading, installing, and validating. Commented Feb 27, 2016 at 12:48
  • 1
    Can someone please tell me how to check file checksum for using certUtil generated Hash ? command line. Would that be just use the same commandline to generate the Hash on the file (after the file was received on the target machine) ?
    – rvpals
    Commented Jun 13, 2016 at 14:42
30

I personally use Cygwin, which puts the entire smörgåsbord of Linux utilities at my fingertip --- there's md5sum and all the cryptographic digests supported by OpenSSL. Alternatively, you can also use a Windows distribution of OpenSSL (the "light" version is only a 1 MB installer).

4
  • 3
    For just checking a checksum Cygwin seems a little heavy. Especially since there are 5KB executable for checking the MD5 Commented Jan 26, 2009 at 2:52
  • 3
    It might be heavy but it is a valid answer, particularly when considering a Unixy program (MySQL) is involved.
    – Adam Hawes
    Commented Jan 26, 2009 at 12:33
  • 3
    For those of us who consider Cygwin an essential tool, it's a perfect answer.
    – Zenexer
    Commented Aug 6, 2013 at 6:26
  • 8
    It is worth noting that md5sum also comes with git bash (mingw) Commented Jun 13, 2015 at 17:36
15

Any MD5 will produce a good checksum to verify the file. Any of the files listed at the bottom of this page will work fine. http://en.wikipedia.org/wiki/Md5sum

8
  • 9
    This answer is no longer good advice. MD5 is vastly insecure nowadays. Using MD5 to validate downloaded files is not secure.
    – antiduh
    Commented Oct 28, 2015 at 20:12
  • 23
    @antiduh Seeing as you get the hash from the same place you download it from, your argument is moot. You're limited by the hash provided by the website.
    – J.J
    Commented Mar 1, 2016 at 14:19
  • 8
    Let's note that the user just wants to verify that the downloaded file has not been corrupted. If you take a look at https://en.wikipedia.org/wiki/MD5#Security you will come across this key sentence in the opening paragraph: "Although MD5 was initially designed to be used as a cryptographic hash function, it has been found to suffer from extensive vulnerabilities. It can still be used as a checksum to verify data integrity, but only against unintentional corruption." Commented Jul 6, 2016 at 0:36
  • 2
    @J.J A lot of official websites make you download the actual binary from another domain, so the argument is valid. You can download a modified VLC from a malicious mirror via the official site, which will be detected by a checksum.
    – Hey
    Commented Aug 22, 2017 at 10:50
  • 4
    @antiduh I asked not because I'm too lazy to search, but because RTFM is never an appropriate 'answer' on Stackoverflow (which is what your answer implied). Commented May 2, 2018 at 16:24
9

On Windows : you can use FCIV utility : http://support.microsoft.com/kb/841290

On Unix/Linux : you can use md5sum : http://linux.about.com/library/cmd/blcmdl1_md5sum.htm

3
  • 2
    FCIV isn't pre-installed. CertUtil is (on newer Windows OSes) - See answer below: stackoverflow.com/a/28922976/3063884
    – CJBS
    Commented Mar 26, 2015 at 17:27
  • Hence the download location is provided.
    – sandyiit
    Commented Jul 26, 2017 at 11:09
  • broken, links. Maybe stackoverflow should run bots that check all the threads for broken links, I mean this is the future. Commented Apr 3, 2023 at 14:01
6

Checksum tabs: http://code.kliu.org/hashcheck/

This has worked great for me on windows for a while now. It allows easy copying and pasting of checksums. It has box to type/paste check sums from webpages and show matches or non matches quite well.

2
  • 2
    This handy little utility is rather understated here. First I have no relation to the author(s)---I just think it is a great utility! It lets you generate a hash file of your choice from the context menu in Windows Explorer for a single file or a group of files. You can later double-click that hash file to automatically run a hash verification of those files. I use this frequently to generate a hash for large files I want to copy, then copy the hash file with it, and at the destination, double-click to verify they survived intact. Commented May 20, 2015 at 22:02
  • 1
    Excellent solution, but the link is outdated. The safest place to get this software now is github.com/gurnec/HashCheck
    – asachet
    Commented Nov 23, 2018 at 16:29
5

On MySQL.com, MD5s are listed alongside each file that you can download. For instance, MySQL "Windows Essentials" 5.1 is 528c89c37b3a6f0bd34480000a56c372.

You can download md5 (md5.exe), a command line tool that will calculate the MD5 of any file that you have locally. MD5 is just like any other cryptographic hash function, which means that a given array of bytes will always produce the same hash. That means if your downloaded MySQL zip file (or whatever) has the same MD5 as they post on their site, you have the exact same file.

3

When I worked with Windows, I found handy HashTab 3rd party tool. It shows MD5, SHA-1 check sums in one of file properties tabs. http://implbits.com/products/hashtab/

3

7-Zip can be used to generate hashes for files, folders of files, and trees of folders of files. 7-Zip is small footprint and a very useful compression utility. http://7-zip.org/

2
  • While it is true that 7-zip provides hashes for all of the items listed above, it lacks a way to simply copy-paste it's results directly. CertUtil, since it is a CMD program, does provide copy-paste functionality.
    – Jonathin
    Commented Apr 28, 2018 at 22:55
  • It's also possible to use 7z.exe via the CMD, for example 7z.exe h -scrcSHA256 -- /path/to/your/file.txt produces a sha256 hash.
    – Elpy
    Commented Apr 25, 2019 at 13:36
3

To calculate md5 of all the files in the current directory in windows 7

for %i in (*) DO CertUtil -hashfile %i MD5
2

Download fciv.exe directly from http://www.microsoft.com/en-us/download/confirmation.aspx?id=11533

shell> fciv.exe [yourfile]

will give you md5 by default.

You can read up the help file fciv.exe -h

2

Just to add another option for Windows users, the Get-FileHash PowerShell cmdlet can be used (https://technet.microsoft.com/en-us/library/dn520872.aspx).

Example usage: Get-FileHash MyImage.iso -Algorithm MD5

If all you're after is just the raw hash then: (Get-FileHash MyImage.iso -Algorithm MD5).Hash

1

The Powershell utility Get-FileHash worked perfectly for me.

https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash

1

Best utility for Windows is HashCheck that is now on GitHub. https://github.com/gurnec/HashCheck/releases/tag/v2.4.0

Install HashCheck. Now right click on the file -> Create verification file. It will create a file.extension.md5 file with MD5 code in it.

Love it.

0

Note that the above solutions will not tell you if your installation is correct only if your install.exe is correct (you can trust it to produce a correct install.)

You would need MD5 sums for each file/folder to test if the installed code has been messed with after the install completed.

WinMerg is useful to compare two installs (on two different machines perhaps) to see if one has been changed or why one is broken.

0

for sure the certutil is the best approach but there's a chance to hit windows xp/2003 machine without certutil command.There makecab command can be used which has its own hash algorithm - here the fileinf.bat which will output some info about the file including the checksum.

0

Hashing is a standalone application that performs MD5, SHA-1 and SHA-2 family. Built upon OpenSSL.

0

I like to use HashMyFiles for windows.

0

QuickHash an open source tool supporting MD5, SHA1, SHA256, SHA512 and available for the Linux, Windows, and Apple Mac.

https://sourceforge.net/projects/quickhash/

0

In HPUX ( hp UNIX)

Please install the md5sum package on your UNIX machine for example, if there is a file called a.txt

shell > md5sum a.txt
0
-4

Just use win32 Checksum api. MD5 is native in Win32.

1
  • 2
    Have an example of the Win32 API that is small enough for an SO answer and suitable for the asker?
    – Sqeaky
    Commented Feb 21, 2014 at 16:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.