How to Verify Game File Integrity Using SHA Hashes

You just spent two hours downloading a 90 GB game. But did the download complete without any corruption? Is that mod you found on a forum actually safe? How does Steam know when a game file is corrupted and needs to be re-downloaded? The answer to all of these is the same: cryptographic hash functions.

What Is a Hash?

A cryptographic hash function takes any input — a file, a string of text, an entire game installation — and produces a fixed-length string of characters called a hash or digest. The key properties that make hashes useful are: the same input always produces the same hash (deterministic), even a tiny change to the input produces a completely different hash (avalanche effect), and you cannot work backwards from a hash to reconstruct the input (one-way). For example, SHA-256 always produces a 64-character hexadecimal string regardless of whether the input is a single letter or a 100 GB game file.

How Game Platforms Use Hashes

Steam's "Verify Integrity of Game Files" — When you right-click a game in Steam and select Properties → Local Files → Verify integrity of game files, Steam calculates the hash of every file in your installation and compares them against the hashes stored on Steam's servers. Any file with a mismatched hash gets re-downloaded. This catches corrupted files, incomplete updates, and unauthorized modifications.

Epic Games Launcher does the same thing with its Verify button. GOG Galaxy has a similar feature. The process is identical: compute local hashes, compare against known-good hashes, replace any mismatches.

Verifying Downloaded Files

When you download a game or mod from a website, the publisher often provides a SHA-256 hash alongside the download link. After downloading, you compute the hash of the file you received and compare it to the published hash. If they match, the file is exactly what the publisher intended — no corruption during download, no tampering, no incomplete transfer.

This is especially important for large downloads (where corruption is more likely), files from mirrors or third-party hosts, mods from community sites, and emulator ROMs and BIOS files.

Checking Mod Safety

The PC gaming modding community is incredible, but it also carries risks. Malicious actors occasionally distribute mods containing malware. When a trusted community member verifies a mod and publishes its hash, you can download the mod from any source and verify you got the exact same file by checking the hash. If the hash doesn't match, the file has been modified — possibly to include malware.

This came into sharp focus with incidents like the Minecraft mod malware outbreak in 2023, where compromised mods on CurseForge infected players' computers. Hash verification would have caught the tampered files immediately.

Which Hash Algorithm to Use

SHA-256 is the gold standard for file verification. It's fast enough for large files and cryptographically secure against all known attacks. SHA-1 is still commonly used (Git uses it for commit hashes) but has known theoretical weaknesses. It's fine for detecting accidental corruption but not ideal for security-sensitive verification. MD5 is still shown by some download sites but is cryptographically broken — it's possible to create two different files with the same MD5 hash. Use SHA-256 whenever possible.

How to Check a Hash

On Windows, open PowerShell and run: Get-FileHash "C:\path\to\file.zip" -Algorithm SHA256. On Linux/Mac: sha256sum /path/to/file.zip. Compare the output to the published hash. They should be identical, character for character.

For quick text hashing — checking config strings, comparing short values, or learning how hashes work — our SHA hash generator lets you compute SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser.

Real-World Gaming Example

Say you're downloading a shader preset for ReShade. The creator posts on Reddit: "Download link: mega.nz/... SHA-256: a3f8b2c..." You download the .zip file and check its hash. If it matches, you know the file is exactly what the creator uploaded — even if it passed through multiple servers on the way to you. If it doesn't match, delete it and find the file from a different source.