Ecosystem · Command line

Command-line hashers

Hash a file from the terminal in one command. The most-used utilities ship with the OS (sha256sum, md5sum on Linux; shasum on macOS); newer ones (b3sum) install from package managers. They all share one output format: DIGEST FILENAME.

The big six

Command	Algorithm	Ships with
`md5sum`	MD5	GNU coreutils
`sha1sum`	SHA-1	GNU coreutils
`sha224sum, sha256sum, sha384sum, sha512sum`	SHA-2 family	GNU coreutils
`b2sum`	BLAKE2b/2s	GNU coreutils
`b3sum`	BLAKE3	Separate package (BLAKE3 team)
`shasum`	SHA-1 / SHA-2 / SHA-3 family	macOS, perl-based

Usage patterns

# Single file
sha256sum file.bin

# Generate a manifest
sha256sum *.tar.gz > SHA256SUMS

# Verify a published manifest
sha256sum --check SHA256SUMS

# With BLAKE3 (much faster on large files)
b3sum file.bin

# On macOS where sha256sum is missing
shasum -a 256 file.bin

# Pipe / stdin
curl -sL https://example.com/file.bin | sha256sum

Output format gotchas

The two spaces between hash and filename are part of the format. --check requires them.
A leading * on the filename indicates binary mode; a space means text mode. Modern coreutils ignores the distinction; older / Windows-aware tools care.
BSD-style output (SHA256 (file.bin) = digest) is the macOS default for shasum -pand OpenBSD’s tools.

Quirks per OS

Linux , GNU coreutils is the default; sha256sum exists out of the box.
macOS , ships shasum (perl) and md5 (BSD). Install GNU coreutils via Homebrew if you want gsha256sum et al.
BSDs , sha256, md5 are the BSD-style binaries with BSD output format.
Windows , PowerShell has Get-FileHash covering SHA-1 / 256 / 384 / 512 and MD5. WSL or installed coreutils for the GNU style.

BLAKE3’s b3sum

BLAKE3’s reference repository ships b3sum: faster than every coreutils hasher on large files, often by an order of magnitude, because of multi-core parallelism. The output format matches coreutils and is therefore drop-in compatible with b3sum --check MANIFEST.

Manifests in the wild

Linux distros , SHA-256 / SHA-512 sums published alongside ISOs.
Releases on GitHub , SHASUMS file uploaded as a release artifact.
Yarn / npm lockfiles , integrity field carries SHA-512 of every package tarball.
Subresource Integrity (SRI) in HTML , integrity="sha384-…" attribute on <script> and <link> tags.