Check a download’s checksum

shasum -a 256 prints the file’s SHA-256 fingerprint; compare it with the one the website publishes. If a single character differs, the file is not the one they released.

How

Print the SHA-256 of the download:

shasum -a 256 ~/Downloads/installer.dmg

Or check it against the published value in one go (two spaces before the name):

echo "PASTE_THE_PUBLISHED_HASH  installer.dmg" | shasum -a 256 -c

Or just ask Titan

Check that the installer I downloaded matches the checksum on their site. Do it with Titan

Titan is an AI that lives on your computer: tell it what you need and it does it while you watch — you press Return, nothing runs by itself. What is Titan?

Titan isn’t on this computer yet. Get Titan, then press the button again — the task will be waiting, typed in.

Related

Download a file from a link in Terminal