How to verify a download with SHA-256 on Windows, macOS and Linux, and what a mismatch means

24 Oct 2026 · 3 min read · ModsDrop

Pictured: BMW M4 F82 2015-2020 – High-Detail Model with Tuning, from the ModsDrop library.

Every file page on ModsDrop shows a SHA-256 hash: a 64-character fingerprint of the exact bytes we host. Checking it on your side takes one command, needs no extra software on any operating system, and answers two questions at once: did the download finish, and is the file on your disk the same file we scanned? Here is how, and what a mismatch means.

What a hash is

A hash function turns a file of any size into a fixed-length string. Change one byte anywhere in the file and the string changes completely. SHA-256 is the function used by software distributors everywhere; two different files producing the same SHA-256 has never been observed. So if the hash of your download matches the one on the page, your file is byte-for-byte what we have, and what VirusTotal scanned.

Windows

Open a command prompt or PowerShell in the folder with the download (type cmd in the folder’s address bar in Explorer, or shift-right-click and choose the PowerShell option). Then either:

certutil -hashfile "filename.zip" SHA256

or, in PowerShell:

Get-FileHash "filename.zip"

Both print the hash. Compare the first and last few characters with the page; if those match, the whole string matches.

macOS

shasum -a 256 filename.zip

in Terminal, from the Downloads folder (cd ~/Downloads first).

Linux

sha256sum filename.zip

Reading the result

Match: the file is complete and identical to ours. Any problem you have with it is the mod’s, not the download’s.
Mismatch, and the file is smaller than the size on the page: the download was cut off. Browsers do this silently on unstable connections and the result looks like a normal zip. Download again.
Mismatch, same size: the file was altered in transit or on disk. Rare; a proxy or a corrupted drive sector, or a download that came from somewhere other than this site. Download again from the page, and if the second copy matches the page, discard the first.
Mismatch between two sites hosting “the same” mod: they are not the same file. One may be a newer version, one may be a repack with something added. The author’s page says which is the original.

When this matters most

Large files on a mobile or shared connection, where truncated downloads are common and the game’s error messages are unhelpful.
Convoy and other multiplayer that requires identical mods: comparing hashes is how a group confirms everyone has the same file before a session.
Native code mods (GTA V scripts and tools), where “is this exactly the file that was scanned” is the whole question.
Reporting a problem: “SHA-256 matches, mod still crashes” tells an author to look at the mod; “SHA-256 differs” tells everyone to look at the download.

What a hash does not do

It does not say whether the mod is good, safe or the author’s own work. It says only that two files are the same. The scan line on the file page, the author’s name inside the archive and the folder structure answer the other questions; the hash is the one that lets you trust those answers apply to the file you actually have.

For uploaders

The hash is computed when your file is published and shown automatically; there is nothing to fill in. If you also publish the file elsewhere, post the same hash there, so downloaders can tell your original from repacks. A mod that circulates with a known hash is a mod that is hard to tamper with quietly.