A checksum is a short fingerprint of a file. If even one byte of the file changes, the fingerprint changes completely. By comparing the checksum of your download against the official one published by the Malairte project, you can confirm the file arrived intact and was not swapped for a malicious copy. Here is how to do it, step by step.

Step 1: Download the file and find the official checksum

Download the wallet or node software from the official Malairte site you reached yourself. On the same official page, locate the published checksum, usually labelled SHA-256, alongside the download. Treat the checksum as trustworthy only because it sits on the genuine official page.

Step 2: Open a terminal in the download folder

On Windows, open PowerShell. On macOS or Linux, open Terminal. Navigate to the folder where the file was saved so the commands can find it. Working in the right folder avoids confusing errors about missing files.

Step 3: Generate the checksum of your file

On Windows PowerShell, run Get-FileHash followed by the file name to produce its SHA-256 value. On macOS, use shasum -a 256 and the file name; on Linux, use sha256sum and the file name. The command prints a long string of letters and numbers - that is your file fingerprint.

Step 4: Compare the two values carefully

Place the value you generated next to the official one and compare them. They must match exactly, character for character. A safe trick is to check the first several and last several characters and the overall length; if anything differs, they do not match. Do not eyeball only the start.

Step 5: Act on the result

If the values match, the file is intact and safe to proceed with installing. If they do not match, stop. Delete the file, do not run it, and download again from the official source. A mismatch means the file was corrupted in transit or, worse, tampered with.

Step 6: Verify a signature too, if one is offered

Some releases include a cryptographic signature in addition to a checksum. If the project publishes one, verifying it proves the file came from the holders of the project signing key, not just that it is unchanged. Follow the official instructions for the signing tool when this is available.

Verifying a checksum takes under a minute once you have done it once. It is the difference between trusting a file because it looked right and knowing it is the genuine release.