CERTUTIL - Hash Values & Base64

Maintained on October 28, 2026

Download pages often list a string like “SHA-256: 3a7bd3e2…”. This is a hash value, used to check that the file you downloaded has not been corrupted or tampered with.

Windows includes the CERTUTIL command, which can calculate hash values without installing any extra software.

What Is a Hash Value?

A hash value is a fixed-length string calculated from the contents of a file. If even one byte of the file differs, the result is completely different. If the published hash matches the hash of your local file, you can confirm that it is the same file.

Basic Usage

Syntax

CERTUTIL -hashfile filename [algorithm]

Calculate

certutil -hashfile setup.exe SHA256

－ □ ×

Command Prompt

Microsoft Windows [Version xx.x.xxxxx.xxx]

C:\users\user>certutil -hashfile setup.exe SHA256

SHA256 hash of setup.exe:

3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b

CertUtil: -hashfile command completed successfully.

C:\users\user>

The second line is the hash value. The wording of the messages depends on the display language of your OS, but the second line is always the hash value.

Omitting the algorithm gives you SHA1

If you omit the algorithm, SHA1 is used. When the publisher provides a SHA-256 value, always specify SHA256 explicitly.

Supported Algorithms

Algorithm	Description
`MD2`, `MD4`	128 bits. Very old; should not be used
`MD5`	128 bits. Old; not suitable for detecting tampering
`SHA1`	160 bits. The default; also considered weak
`SHA256`	256 bits. The most widely used today
`SHA384`	384 bits
`SHA512`	512 bits

It is known that different files with the same MD5 or SHA1 hash can be created deliberately. They can detect accidental corruption, but they are not suited to confirming that a file has not been maliciously altered. Use SHA256 or stronger whenever the publisher provides it.

Compare with a Published Hash

Hash values are long and easy to misread by eye. Passing the published value to findstr gives a reliable match check.

Check

certutil -hashfile setup.exe SHA256 | findstr /I "3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b"

If it matches, the line is displayed; if not, nothing is displayed. The /I option ignores differences in letter case.

チェック

The line CertUtil: -hashfile command completed successfully. appears for every file regardless of the hash. Searching for the hash value itself avoids false positives from that line.

Compare Automatically in a Batch File

This example compares a file passed as an argument with the expected hash value.

verify_hash.cmd

@echo off
setlocal EnableDelayedExpansion

set "FILE=%~1"
set "EXPECTED=%~2"
set "ACTUAL="

for /f "skip=1 delims=" %%H in ('certutil -hashfile "%FILE%" SHA256') do (
    if not defined ACTUAL set "ACTUAL=%%H"
)

set "ACTUAL=!ACTUAL: =!"

if /I "!ACTUAL!"=="%EXPECTED%" (
    echo [OK] The hash values match.
) else (
    echo [NG] The hash values do not match.
    exit /b 1
)
endlocal

Example

verify_hash.cmd setup.exe 3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b

skip=1 skips the heading line, and only the first line obtained (the hash value) is stored in the variable. On older versions of Windows the hash is displayed with a space after every two characters, so !ACTUAL: =! removes the spaces.

Encode and Decode Base64

CERTUTIL can also convert a file to a Base64 string.

Convert

certutil -encode input.bin output.txt

Restore

certutil -decode output.txt restored.bin

Format of the output file

A file created with -encode gets a -----BEGIN CERTIFICATE----- line at the top and an -----END CERTIFICATE----- line at the end, even if the data is not a certificate. -decode restores the file correctly with these lines in place. If you need the bare Base64 text, remove them.

Overwriting an existing file requires -f

If a file with the same name already exists at the destination, the command fails. To overwrite it, add -f, as in certutil -f -encode input.bin output.txt. With -f the file is overwritten without confirmation, so be careful not to specify an important file.

Common Errors

If the file cannot be found, you get an error like this:

－ □ ×

Command Prompt

Microsoft Windows [Version xx.x.xxxxx.xxx]

C:\users\user>certutil -hashfile missing.exe SHA256

CertUtil: -hashfile command FAILED: 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)

CertUtil: The system cannot find the file specified.

C:\users\user>

おすすめ書籍※ 広告を含む場合があります

中小企業経営者のためのRPA入門 RPA導入を成功させる方法

60分でわかる！ AIエージェント　超入門

コマンドラインの黒い画面が怖いんです。

知識・才能ゼロでもらく～に月10万円稼ぐ! よくわかるAI副業超入門

If the file name contains spaces, enclose it in double quotation marks, such as "my file.exe".

On failure a non-zero exit code is returned. When the file is not found it is a negative value such as -2147024894, so check it with IF %ERRORLEVEL% NEQ 0 or || rather than IF ERRORLEVEL 1.

Summary

Task	Command
Calculate SHA-256	`certutil -hashfile file SHA256`
Calculate MD5	`certutil -hashfile file MD5`
Convert a file to Base64	`certutil -encode input output`
Restore from Base64	`certutil -decode input output`