A corrupted IPSW file wastes hours at best (the restore fails mid-flash), and a modified one from a bad source is worse. Verification takes minutes and settles both questions. This guide covers the methods that matter in practice: checksum comparison, file size checks, and source vetting.
Quickest Way: Use the dotIPSW IPSW Verifier
The fastest path is our free IPSW Checksum & Hash Verifier. Drag your .ipsw file onto the page and it computes the SHA-256 hash locally in your browser; the file never leaves your computer, nothing is uploaded, and there’s nothing to install.
If you prefer the manual route (or want to understand what the tool does), the methods below are the same math done by hand.
Why Verify at All?
IPSW files are multi-gigabyte archives of the complete operating system, which makes them vulnerable in three specific ways:
- Incomplete downloads: a network drop can produce a file that looks fine but is missing chunks
- Corruption in transit: transfer errors introduce invisible damage that surfaces mid-restore
- Tampering: files from unofficial sources can be modified, and modified firmware is both a security risk and a guaranteed install failure
The signature check your device performs at install time catches modified files, but only after you’ve connected the device and started the process. Verifying before that means you never get that far with a bad file.
Method 1: Checksum Verification (Most Reliable)
A checksum is a fingerprint computed from the file’s contents. Change one byte anywhere in a multi-gigabyte file and the hash changes completely, so a matching hash proves the file is byte-for-byte identical to the original.
Get the Official Checksum
Apple doesn’t publish checksums through its standard channels, but dotIPSW lists verified SHA-256 and MD5 hashes alongside every firmware download. Find your file and copy the SHA-256 value.
Verify on Mac or Linux
Built-in, no tools needed. In Terminal:
cd ~/Downloads
shasum -a 256 yourfilename.ipswThe first value printed is the SHA-256 hash. (For MD5 instead, use md5 yourfilename.ipsw; it’s faster, but SHA-256 is the standard to prefer.)
Verify on Windows
Windows has no built-in graphical hash checker, so use one of:
- OpenHashTab (free, open source): adds a hash tab to file Properties. Right-click the IPSW, open Properties, switch to the File Hashes tab, and compare SHA-256
- PowerShell (built in):
Get-FileHash .\yourfilename.ipsw -Algorithm SHA256Compare
Match the computed hash against the official one, character for character. Match = the file is intact and unmodified. Mismatch = do not install it.
Method 2: File Size Check (Quick Sanity Test)
Less rigorous than a checksum, but catches obvious truncation in seconds:
- Note the expected size listed with the download on dotIPSW
- Right-click the file and open Properties (Windows) or Get Info (Mac)
- Compare. A meaningful difference (more than a few KB) means an incomplete or altered file
Small differences of a few KB can be normal across regional variants; anything larger fails. Treat this as the quick filter before checksums, not a replacement.
Method 3: Source Verification
The best verification is not needing it: files pulled through Finder or iTunes come straight from Apple’s servers, already guaranteed. When you download from a third-party repository instead, vet the source:
- Reputation: an established track record in the Apple community, not a fresh domain
- HTTPS: the download is encrypted in transit
- Checksums published: a site confident in its files shows their hashes
- No bundled software: legitimate firmware sites don’t require installers, extensions, or “download managers”
Method 4: Structural Inspection (Advanced)
An IPSW is a modified ZIP archive. Renaming the extension to .zip and extracting it should yield BuildManifest.plist, restore metadata, and firmware folders (.dfu / .im4p files). A file that won’t extract, or is missing those components, is damaged. Our IPSW structure guide explains what each component does.
If Verification Fails
- Delete the file. Don’t keep it around for “maybe later”
- Re-download from the same source (or a different one)
- If the second download also fails verification, the problem is your connection or the source: switch networks, use a wired connection, or try a browser with resumable downloads
Never install a file that failed any check. There’s no scenario where it improves with age.
The Habit
Make it a habit: after every download, verify the checksum, check the size, and only then install. It costs two minutes, and it’s the difference between a restore that works the first time and an afternoon in Recovery Mode.