Command line and power tools

Proving two files are identical

Updated 2026-08-08 · 4 min read

A checksum is a fingerprint: any change to the file, however small, changes it completely. One built-in command settles questions that are otherwise pure anxiety — did the download corrupt, did the copy complete, are these two files the same?

The command

shasum -a 256 file.dmg

prints the SHA-256 fingerprint. Uses, in ascending order of how often they save the day:

Verifying a download. Vendors publish hashes next to downloads precisely so you can catch truncation and tampering:

shasum -a 256 ~/Downloads/installer.dmg

Compare against the published value — matching means byte-identical, full stop. (A mismatched hash is also the honest diagnosis behind some "app is damaged" errors: the download really is incomplete.)

Comparing two files. Same hash, same content — names and dates notwithstanding:

shasum -a 256 report-v2.pdf ~/Backup/report-final.pdf

Auditing a whole copy. After migrating a folder to a new drive:

cd /original/folder && shasum -a 256 -r . > ~/manifest.txt
cd /copied/folder && shasum -a 256 -c ~/manifest.txt | grep -v OK

The manifest records every file's fingerprint; -c re-checks them at the destination and the grep shows only failures. Silence is the good outcome — a proven-faithful copy, which "the sizes look right" never proves.

md5, and which algorithm to use

md5 is faster and its collisions are irrelevant for accident-detection, so old manifests and download pages still use it — fine for integrity, not for security. Default to SHA-256: same command everywhere, and its guarantees cover both cases.

Where this belongs in a file workflow

Checksums are the verification layer duplicate-finders and backup tools use internally — two files with one hash are one file twice. Running the manifest audit after any migration that matters (photo archives, project handoffs, the pre-reformat evacuation of a drive) converts hope into a checked fact.

Common questions

What does it mean if checksums differ by one character?

Any difference means the files differ — the size of the hash change says nothing about the size of the content change. Re-copy or re-download.

Are checksums enough to deduplicate files?

Matching SHA-256 hashes is decisive for identical content. Tools add size pre-filters only for speed; the hash is the verdict.