Skip to main content
The hash command calculates the SHA256 hash of an installer file, which is required for WinGet package manifests.

​
Syntax

winget hash <file> [options]

​
Required Arguments

​
file
path
required
Path to installer file

​
Options

​
-f, --file
path
File path (alternative to positional argument)
​
-m, --msix
flag
Also calculate SignatureSha256 for MSIX packages

​
Examples

Hash an installer: 
winget hash installer.exe
Hash an MSIX package: 
winget hash package.msix --msix
Hash using explicit path: 
winget hash --file "C:\Downloads\setup.exe"

​
Output Format

​
Standard Installer

InstallerSha256: 9C3A6C8D2E5F7B8A1D4E6C8B9A2D5F7E8C1B4A7D9E2F5C8B1A4D7E9F2C5B8A1D

​
MSIX Package

With --msix flag: 
InstallerSha256: 9C3A6C8D2E5F7B8A1D4E6C8B9A2D5F7E8C1B4A7D9E2F5C8B1A4D7E9F2C5B8A1D
SignatureSha256: 1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5A6B7C8D9E0F1A2B

​
Use Cases

​
Creating Manifests

When creating WinGet manifests: 
# Calculate hash
winget hash PowerToysSetup-0.71.0-x64.exe

# Use in manifest
InstallerSha256: 9C3A6C8D...

​
Verifying Downloads

Verify installer integrity: 
winget hash downloaded-installer.exe
# Compare with published hash

​
MSIX Packages

For MSIX packages, get both hashes: 
winget hash package.msix --msix
Manifest requires both: 
Installers:
  - Architecture: x64
    InstallerType: msix
    InstallerUrl: https://example.com/package.msix
    InstallerSha256: 9C3A6C8D...
    SignatureSha256: 1A2B3C4D...

​
Hash Format

SHA256 hashes are:
  • 64 hexadecimal characters
  • Case-insensitive
  • Used for installer verification

​
Error Handling

​
File Not Found

Error: File not found
Path: C:\installer.exe

​
MSIX Signature Error

InstallerSha256: 9C3A6C8D...
Error: Failed to extract MSIX signature hash
Ensure the file is a valid signed MSIX package

​
Integration with Manifests

Use hash output directly in manifests: 
Installers:
  - Architecture: x64
    InstallerType: exe
    InstallerUrl: https://github.com/example/releases/download/v1.0/installer.exe
    InstallerSha256: 9C3A6C8D2E5F7B8A1D4E6C8B9A2D5F7E8C1B4A7D9E2F5C8B1A4D7E9F2C5B8A1D

​
Exit Codes

  • 0 - Success
  • 0x80070002 - File not found
  • 0x8A150041 - MSIX signature extraction failed
The hash command reads the entire file to calculate the hash, which may take time for large installers.
For MSIX packages, the --msix flag is required to extract the SignatureSha256, which is mandatory in WinGet manifests.

Build docs developers (and LLMs) love

Get started for freeTalk to us