Introduction
Checking a downloaded file before opening it can prevent malware, corrupted data, and accidental installation of the wrong program. A file may look normal while being incomplete, modified, or different from what the publisher intended. File integrity checks help you confirm that the download is complete and matches a trusted reference.
Start With the Source
Integrity checking begins before the download. Use the official publisher or a reputable repository, and confirm the address carefully. Record the expected filename, version, file type, and approximate size. If the download came from an unsolicited message or an unknown website, treat it as untrusted even when the name looks professional.
Check the Filename and Extension
Show file extensions in your operating system so that they are not hidden. Be cautious with double extensions such as a document followed by an executable extension. Also watch for spelling changes, unusual symbols, and files that do not match the description. An image, document, or archive should not unexpectedly arrive as an executable installer.
Compare the File Size
Compare the downloaded size with the size published by the developer when that information is available. A small difference may occur because of packaging or updated releases, but a major difference can indicate an incomplete or incorrect download. If the file is much smaller than expected, download it again from the verified source.
Use Checksums
Many developers publish a checksum, such as SHA-256, beside a release file. A checksum is a digital fingerprint calculated from the file’s contents. Use a trusted checksum utility, calculate the value locally, and compare every character with the publisher’s value. A match shows that the file is unchanged from the referenced version. A mismatch means you should not open the file until the reason is understood.
Check Digital Signatures
Some installers are digitally signed. The signature can help identify the publisher and show whether the file was altered after signing. Review the signature details through your operating system’s file properties. A missing, invalid, or unexpected signature is a reason to pause and obtain the file again from an official source.
Scan Before Opening
Keep security software updated and scan the file before opening or extracting it. Scan archives as well as the files inside them. Be especially careful with scripts, executable files, office documents containing macros, and files that request administrator access. Do not ignore a security warning simply because the download page looked legitimate.
Handle Archives Carefully
Extract archives into a separate folder instead of opening unknown files directly. Review the contents first and look for unexpected programs, scripts, shortcuts, or files with misleading names. Do not run anything until the archive and its contents have been verified.
What to Do With a Failed Check
If a checksum does not match, the signature is invalid, or the security scan reports a threat, quarantine or delete the file. Do not repeatedly open it to test whether the warning is serious. Return to the official source, verify the release version, and download a fresh copy using a secure connection.
Final Checklist
- Verify the publisher and download source.
- Compare the filename, extension, version, and size.
- Use SHA-256 or another published checksum when available.
- Review digital signatures.
- Scan installers, archives, scripts, and documents.
- Never ignore a mismatch or security warning.
Conclusion
File integrity checks are simple but powerful. By verifying where a file came from, what type it is, whether its size is expected, and whether its checksum or signature matches, you can reduce the chance of opening corrupted or tampered content.