How to Check Your Genome Download Isn't Corrupted

Why a genome file can be broken without looking broken

A whole-genome download is not one small file. A BAM or CRAM alignment file, a pair of FASTQ files and a VCF can add up to many gigabytes, and every one of those bytes has to arrive intact. Downloads get interrupted, browsers sometimes save a partial file under the full name, external drives develop bad sectors, and copy jobs fail halfway without much fuss.

The trouble is that a damaged genome file usually looks fine in a folder. It has the right name and a plausible size. You often only find out months later, when an analysis tool stops with a cryptic error or, worse, quietly reads only part of the data. Checking right after the download, and again after every copy, turns that silent risk into a thirty-second habit.

What a checksum is (and MD5 vs SHA-256)

A checksum, or hash, is a short fingerprint calculated from every byte of a file. Change a single byte and the fingerprint changes completely. If the fingerprint you calculate on your computer matches the one the sender calculated on theirs, you can be confident the two files are identical.

You will mostly meet two kinds:

MD5 has a bad reputation, and for security it deserves it. The IETF’s RFC 6151 says MD5 must not be used where collision resistance matters, such as digital signatures, while noting that using it to catch accidental errors is still acceptable. The GNU md5sum manual makes the same point and suggests SHA-2 for stronger hashing. For checking that a download from your own provider arrived intact, MD5 does the job. If you get a choice, use SHA-256.

Where to find the expected value

To verify a download you need a reference value from the sender. If your provider supplies one, it is usually in one of these places:

• Next to the download link on your results or data page, often labelled MD5 or SHA-256.
• A small companion file with the same name plus .md5 or .sha256, or a list file such as md5sums.txt that covers several files.
• From support, if you ask. It is a reasonable request for files this large.

If your provider does not supply a checksum, calculate one yourself as soon as the download finishes and keep it in a text file beside your data. That cannot prove the original download was perfect, but it lets you prove every later copy matches the first one, which is exactly what you need for backups. Our genome storage and backup guide covers how to arrange those copies.

Commands for Mac, Linux and Windows

All of these run in a terminal: Terminal on a Mac, any terminal on Linux, and Command Prompt or PowerShell on Windows. Nothing needs installing. Replace genome.bam with your file name; dragging the file into the terminal window usually pastes its full path for you. Expect a pause on big files, since every byte has to be read.

macOS

md5 genome.bam
shasum -a 256 genome.bam

md5 prints a line like MD5 (genome.bam) = …. Note the -a 256: without it, shasum uses SHA-1, which is not the value you want.

Linux

md5sum genome.bam
sha256sum genome.bam

Windows

In Command Prompt, name the algorithm explicitly:

certutil -hashfile genome.bam SHA256
certutil -hashfile genome.bam MD5

In PowerShell, Get-FileHash uses SHA-256 by default:

Get-FileHash genome.bam
Get-FileHash genome.bam -Algorithm MD5

PowerShell shows the hash in capital letters, while most providers and Linux tools use lowercase. That is cosmetic: hexadecimal digits are the same value in either case, so 3CBC… and 3cbc… match.

Checking many files at once

If you were given a list file where each line is a hash followed by a file name, Linux and macOS can check every file in one go. Run this from the folder that holds the data:

# Linux
md5sum -c md5sums.txt
sha256sum -c sha256sums.txt

# macOS
shasum -a 256 -c sha256sums.txt

Each file is reported as OK or FAILED. To make your own list for future checks on Linux, run sha256sum *.bam *.vcf.gz > sha256sums.txt (on a Mac, shasum -a 256 in place of sha256sum).

Format-level checks for BAM, CRAM and compressed files

Checksums answer “is this the same file?” A second kind of check answers “does this file look complete?” These are handy when you have no reference checksum. They need the free bioinformatics tools samtools and htslib, which are not built into any operating system.

• samtools quickcheck -v genome.bam checks that a BAM or CRAM file has a valid header and, for BAM and CRAM, an intact end-of-file marker. It prints the names of any files that fail. Per the samtools documentation, it does not read the middle of the file, so it catches truncated downloads but not damage inside the file.
• gzip -t genome.vcf.gz tests the integrity of a gzip-compressed file, such as a .fastq.gz or .vcf.gz, and reports an error if the compressed data is damaged or cut short. Genomics tools often use BGZF, a block-gzip format that is compatible with ordinary gzip.
• bgzip -t genome.vcf.gz does the same test with htslib’s own tool. The current bgzip manual lists -t/--test; older installed versions may not have it.

If you only want a quick look at what a file is before anything else, our raw file inspector reads it in your browser without uploading it. For a full integrity guarantee, though, nothing beats a matching checksum.

What to do if the checksum doesn’t match

Don’t panic, and don’t delete anything you can’t download again. Work through these in order:

1. Check you compared the right things. Same algorithm on both sides, the right file (R1 vs R2 FASTQ files are easy to mix up), and no stray space or missing character when you pasted.
2. Check the file finished downloading. Compare the file size with the size your provider lists, if it lists one. A partly downloaded file is the most common cause.
3. Download it again, ideally on a wired or stable connection, using the provider’s own download method if it offers a dedicated tool or link. Then recalculate.
4. If a copy fails but the original passes, the copy or the destination drive is the problem. Copy again, and if failures repeat on the same drive, stop trusting that drive.
5. If fresh downloads keep failing, contact the provider with the file name, the value they publish, and the value you got. Their copy or their published value may be wrong.

A simple routine to keep

• Download each file, then calculate its checksum before doing anything else.
• Compare against the provider’s value if they supply one; otherwise save yours as the reference.
• Keep a sha256sums.txt or md5sums.txt next to the data, and a copy of it with each backup.
• Re-check after every copy to a new drive or cloud bucket, and occasionally on old backups.
• Encrypt the copies that leave your computer; see how to encrypt your genome files. A checksum works the same on an encrypted file as on any other, so check the encrypted copy too.

Not sure which files you should have received in the first place? What’s included walks through the usual deliverables of a whole-genome test.

Common questions

Keep going

Sources

Checked in October 2026: command syntax and behaviour against the GNU coreutils md5sum and sha256sum manuals, the Perl shasum documentation, the FreeBSD md5 manual (the macOS md5 tool follows the same format), Microsoft’s certutil and Get-FileHash documentation, the samtools quickcheck and bgzip manuals, the GNU gzip manual, and RFC 6151 on MD5. We did not name any company as publishing checksums because we could not confirm current provider practice from official pages; ask your provider directly.

• IETF RFC 6151: Updated security considerations for MD5
• GNU coreutils: md5sum invocation
• Microsoft Learn: Get-FileHash
• Microsoft Learn: certutil
• samtools quickcheck manual
• htslib bgzip manual

Educational content, not medical advice. A genetic result is information, not a diagnosis; for anything medically important, talk to a qualified clinician or genetic counselor. Some outbound links are affiliate links; see the disclosure.