Verify with SHA256
Check that an installer you downloaded is exactly the one Microsoft published.
A SHA256 checksum is a fingerprint of a file. Change one byte and the fingerprint changes completely. MOFA publishes the SHA256 for every installer it tracks, so you can download a package, hash it, and compare. A match means the file arrived untouched.
Check a file you already have â
shasum -a 256 ~/Downloads/Microsoft_Word_16.114.pkgThe output is the checksum followed by the file name:
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Microsoft_Word_16.114.pkgDownload and verify in one go â
If you are scripting it, let shasum do the comparison. Paste the published checksum, two spaces, then the file name, and shasum reports OK or FAILED.
curl -L -o Microsoft_Word_16.114.pkg "https://go.microsoft.com/fwlink/?linkid=525134"
echo "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Microsoft_Word_16.114.pkg" | shasum -a 256 -cMicrosoft_Word_16.114.pkg: OKSwap in the checksum from the MOFA page for the file you downloaded. The one above is only an example. The two spaces between the checksum and the file name are required. That is the format shasum writes and the format it reads back with -c. The exit code is 0 on a match and 1 on a mismatch, so it slots straight into a deployment script.
Where to find the checksums â
SHA256 is the one to trust. It is part of the SHA-2 family and has no known practical collisions. MOFA publishes both, and the SHA1 guide works the same way with -a 1.
Further reading â
Checksum does not match? Download the file again first. A partial or interrupted download is by far the most common cause.