Where to find official hash values for Windows 10 ISO images? (solved) - Page 1
Forum section: electronics / general

author: Logan
author_rank: Frequent Contributor
timestamp: March 07, 2021, 04:00:27 pm
content: There used to be a official page showing Windows 7 SHA1 values, but now we seem cannot verify Windows 10 ISO files through a reliable source, really?

author: SilverSolder
author_rank: Super Contributor
timestamp: March 07, 2021, 05:58:17 pm
content: Microsoft has been hacked - maybe they removed the list?

author: Ian.M
author_rank: Super Contributor
timestamp: March 07, 2021, 06:23:21 pm
content: Nope. The hashes are still there on the MS WIN10 download page, *BUT* you cant let MS determine you are running Windows, or it dumbs it down and only offers 'Update Now' and 'Download Tool Now' (media creation tool). ISOs made by the media creation tool do *NOT* have verifiable checksums/hashes, as they are built on-the-fly!Either use a non-windows device or fake your browser's user agent to that of a non-windows device,e.g. Safari on macOS:Code:Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15which is probably the most 'vanilla' non Windows choice,Once its faked, gotohttps://www.microsoft.com/software-download/windows10and select the Windows version and then the language you want an ISO for, (or any if you just want the hashes) then click the (+) to expand 'Verify your download' to see a list of SHA256 hashes for *ALL* languages and 32/64 bit releases for the currently available Windows 10 version you selected as the first step.

author: Logan
author_rank: Frequent Contributor
timestamp: March 08, 2021, 11:44:43 am
content: Solved. Thank you so much!

author: gmb42
author_rank: Frequent Contributor
timestamp: March 09, 2021, 02:40:51 pm
content: Also note if you have MSDN access that all the ISOs are listed for download along with their SHA 256.

author: Yusufsuleman
author_rank: Newbie
timestamp: October 16, 2023, 05:04:52 pm
content: It's crucial to ensure you're getting them from a legit source. Unfortunately, Microsoft doesn't provide SHA1 values for Windows 10 ISOs officially anymore.

author: Ian.M
author_rank: Super Contributor
timestamp: October 16, 2023, 06:30:54 pm
content: SHA-1 is *broken* (See:https://en.wikipedia.org/wiki/SHA-1) so even if MS provided SHA-1 hashes that wouldn't validate the ISOs. SHA-256 hashes are still available, as described above.

author: golden_labels
author_rank: Super Contributor
timestamp: October 17, 2023, 07:56:55 am
content: The thread has been resurrected by a spammer, so this shouldn’t lead to renewed discussion. But, given importance of the topic and that somebody may be misled by the message, perhaps a comment is needed.These hashes detect transmission/storage errors, not protect against intentional attacks. This applies to SHA-1, SHA-256 or any other hash equally. For this purpose not only SHA-1, but even MD5 is and will remain a suitable tool. Unlike with e.g. Linux distros, where ISOs are served by untrusted, third party volunteers, these images, links to the images and hashes come from servers at the same trust level. So there is only a marginal security advantage(1)for a typical person. There are particular scenarios, when this may still be relevant. For example: a friend burned the DVD for you. Or your government may attack your high-bandwidth connection, but you have an option to use a secure low-bandwidth channel to obtain the hash. Then see what Ian.M said above. But these are not what most people deal with.If you are an average user and obtained an ISO and the hash from the same source, then do not delude yourself. You are not following some first class security practices, because you used SHA-256 and not that horrible, broken SHA-1.(1)There are two or three separate contexts involved, so technically there is a lower chance of being affected by an attack in the future. But this advantage is not as notable, as the brain tries to deceive us into thinking it is. Human mind simply fails to deal with uncomprehensible orders of magnitudes found in security and distinction between future and “future past” perspectives.