when it comes to downloading files from the internet™, you probably want to make sure, that those files are not altered during the download phase. there are several important steps to remember, like always using encrypted connections and only using trusted sites (read this article to understand why download sites are bad). to verify the integrity of a download, you need checksums. here's how to automatically generate checksums for each file you obtain from the internet.

install software

open up terminal.app from your utilities folder and install homebrew using this command:

$ /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

if you (already) installed homebrew, continue installing node and openssl:

$ brew install node openssl

again, if you (already) installed node, continue installing osx-notifier:

$ npm install -g osx-notifier

create shell script

screenshot: checksum.sh script

still in terminal, open up nano and create a new file: nano checksum.sh:


# calculate checksum using openssl
sha1sum=$(openssl sha1 "$1")
sha1sum=${sha1sum#*= }

# get filename from full path for notification

# send notification using osx-notifier
/usr/local/bin/node /usr/local/lib/node_modules/osx-notifier/bin/osx-notifier.js --type info --title "$fileName" --subtitle "SHA1 Checksum:" --message "$sha1sum"

if you want md5 checksums instead, just change the script from above to match your personal preferences.

important: please remember the path to your checksum.sh.

folder action for downloads folder

screenshot: applescript editor, checksum added files.scpt

open script editor from utilities folder, create a new script file (i.e. checksum added files.scpt) and save it to folder ~/Library/Scripts/Folder Action Scripts/ (create folder if it does not exist).

this is the content for your script:

on adding folder items to this_folder 	after receiving added_items
	repeat with currentFile in added_items
			do shell script "~/Tools/checksum.sh " & quoted form of POSIX path of currentFile
		end try
	end repeat
end adding folder items to

please make sure, that the path to your checksum.sh is correct and has a trailing blank space just before the quotation mark.

last step to do is assigning this script as a folder action. to do so, just open the context menu of the downloads folder („ctrl-click“ or „right click“) in your home directory and choose „Services » Folder Actions Setup…“. from the list of scripts highlight checksum added files.scpt. save and exit. done.

next time you add a file to the downloads folder (generally by downloading stuff) the folder action will start the applescript, which then will trigger the shell script to calculate the checksum and send it to notification center.

you can try if it works by downloading the tool ransomwhere? from objective-see.com.

main picture by sebastian gabriel, license