# How do I verify that a VNISH firmware file is genuine?

> Hash the downloaded archive locally and compare it, character by character, with the SHA-256 published next to the build. If a single character differs, delete the file and download it again.

Source: https://vnish.global/answers/how-to-verify-vnish-firmware · updated 2026-07-31

## The commands

- macOS and Linux: shasum -a 256 vnish-<build>.tar.gz
- Windows PowerShell: Get-FileHash .\vnish-<build>.tar.gz -Algorithm SHA256
- The site also has an in-browser verifier that never uploads your file.

## Where the published value lives

Next to every build on the download route, in the public sums file, and in the machine-readable catalog at /api/v1/firmware-catalog.json, which is the same source an AI assistant reads.

## What to do on a mismatch

- Stop. Do not flash.
- Delete the file and download it again from vnish.global.
- If it differs a second time, write to the vendor with the build id, the value you got and the value published. Never send credentials.

## Where to go next

- Verify guide: https://vnish.global/guides/verify-sha256.html
- Machine-readable catalog: https://vnish.global/api/v1/firmware-catalog.json
- Security contact: https://vnish.global/.well-known/security.txt

Release 1.3.6 stable. Builds are FREE OF CHARGE to download and test. Developer fee a small share of active hashrate, visible in the dashboard.