How to verify a Minecraft jar checksum before you run it

Why bother

A Minecraft server jar is a program. When you start it, it runs with your user's permissions: it can read your files, open network connections, and do anything else you could do. A plugin jar is the same, loaded into that program.

So the question "is this file exactly what the author published" is worth ten seconds. It catches two different problems:

• A broken download. Truncated files and bad mirrors are common and produce confusing errors that look like bugs in the software.
• A substituted file. Rarer, much worse, and a checksum is the only cheap way to notice.

Get the expected hash from the publisher

The checksum is only meaningful if it comes from the publisher rather than from the same page that gave you the file. Every checksum on this site comes from the project's own API, in the same response as the download URL, and we never compute one ourselves. A hash we calculated would only prove what we downloaded, which is not the question you are asking.

Server jars, plugin releases and Java builds on this site all show theirs next to the file.

Check it

Every platform has this built in. Nothing to install.

Linux

sha256sum paper-26.2-142.jar
sha512sum paper-26.2-142.jar
sha1sum   minecraft_server.1.21.8.jar

macOS

shasum -a 256 paper-26.2-142.jar
shasum -a 512 paper-26.2-142.jar
shasum -a 1   minecraft_server.1.21.8.jar

Windows, PowerShell

Get-FileHash paper-26.2-142.jar -Algorithm SHA256
Get-FileHash paper-26.2-142.jar -Algorithm SHA512
Get-FileHash minecraft_server.1.21.8.jar -Algorithm SHA1

Compare the output with the published value. Case does not matter. Everything else does.

Comparing by eye across 128 hex characters is how people convince themselves a mismatch matches, so let the machine do it:

# Linux and macOS. Prints OK or FAILED.
echo "<published-hash>  paper-26.2-142.jar" | sha256sum --check

Which algorithm to use

Use whichever the publisher published. If they publish more than one, prefer the strongest:

Algorithm	Good for	Notes
SHA-512	authenticity	Preferred where available. Modrinth publishes it.
SHA-256	authenticity	Strong. PaperMC publishes it.
SHA-1	detecting corruption	Mojang publishes it. Old, but it is what exists for official jars.
MD5	nothing	Do not rely on it.

SHA-1 being weak does not make Mojang's checksums useless: they still catch every truncated or corrupted download, which is the common case by a wide margin. It means SHA-1 alone is not proof against someone who can substitute the file, which is why you should also care that the URL is Mojang's own host over https.

Where the file came from matters too

A checksum answers "is this the file they published". It does not answer "should I trust the publisher". Two habits cover the rest:

• Download from the project's own host. Every download link on this site points at the publisher's release, never at a copy of ours. We do not mirror files, which means there is no version of us to compromise.
• Be suspicious of re-uploads. A jar from a forum post, a Discord attachment or a link aggregator has no chain back to the author. If a re-upload has no published hash, there is nothing to check it against, and that is the point.

Automate it in a start script

If you update a server regularly, put the check in the script rather than relying on yourself remembering:

#!/usr/bin/env bash
set -euo pipefail

JAR="paper-26.2-142.jar"
EXPECTED="<sha256 from the publisher>"

ACTUAL="$(sha256sum "$JAR" | cut -d' ' -f1)"
if [[ "$ACTUAL" != "$EXPECTED" ]]; then
  echo "Checksum mismatch for $JAR. Refusing to start." >&2
  exit 1
fi

exec java -Xms6G -Xmx6G -jar "$JAR" nogui

set -euo pipefail matters here: without it, a failing hash command would leave ACTUAL empty and the script would carry on comparing an empty string.