Verify your download with a checksum

A checksum is a short fingerprint calculated from the exact bytes of a file. If even one byte of the file changes, the fingerprint changes completely. That makes it a simple way to confirm an installer you downloaded is bit-for-bit the same file we published — not corrupted in transit, and not swapped for something else.

Omitly publishes a SHA256SUMS file alongside every release from August 2026 onward so you can check this yourself.

Find the published checksum

The SHA256SUMS file sits in the same folder as the installer, on the same download server. If you have your installer’s download link, you can get the checksum file by replacing the filename in that link with SHA256SUMS — for example a download URL that looks like:

https://releases.omitly.app/stable/v<version>/Omitly_<version>_x64-setup.exe

has its checksums at:

https://releases.omitly.app/stable/v<version>/SHA256SUMS

It’s also linked directly underneath the download buttons on the Omitly homepage, so you don’t have to construct the URL by hand.

If the link comes back not-found, your installer predates checksum publishing (it began in August 2026). Download the current release from the homepage instead — it always has one.

Open it in a browser or text editor — it’s a small plain-text file with one line per release artifact, in the standard sha256sum format:

<hash>  <filename>

You’ll see more lines in there than you have files: the list also includes the .app.tar.gz payloads the auto-updater uses internally, which you won’t have if you downloaded an installer normally. Only the line matching the file you actually downloaded matters to you.

What you’ll need

• The Omitly installer you downloaded.
• The SHA256SUMS file for that same release (see above).

Calculate the checksum

macOS (Apple silicon) — manually, in Terminal:

shasum -a 256 ~/Downloads/Omitly_<version>_aarch64.dmg

(use the filename matching what you actually downloaded — _aarch64.dmg for Apple silicon, _x64.dmg for Intel).

This prints a 64-character hexadecimal string, which you compare by eye against the matching line in SHA256SUMS.

macOS (Apple silicon) — automatically, checking against the downloaded SHA256SUMS file directly. Save SHA256SUMS into the same folder as the installer (for example your Downloads folder), then run this from that folder:

grep 'Omitly_<version>_aarch64.dmg$' SHA256SUMS | shasum -c -

Substitute your own installer’s filename for the Omitly_<version>_...dmg part. This prints OK if it matches. Don’t run a bare shasum -c SHA256SUMS — it checks every line in the file, including the auto-updater .app.tar.gz entries you don’t have, and will report those as failed even though your installer is fine.

Windows (PowerShell):

Get-FileHash .\Omitly_<version>_x64-setup.exe -Algorithm SHA256

Windows (Command Prompt):

certutil -hashfile Omitly_<version>_x64-setup.exe SHA256

Both print a 64-character hexadecimal string. Windows doesn’t ship a one-command equivalent of the macOS (Apple silicon) check above, so compare the printed value by eye against the matching line in SHA256SUMS.

Compare the two values

Compare the value your command printed with the matching line in the published SHA256SUMS file. They should match exactly (the comparison is not case-sensitive — some tools print uppercase, some lowercase).

• They match — the download is intact and identical to what we published. Go ahead and install it: see Install Omitly on macOS (Apple silicon) or Install Omitly on Windows.
• They don’t match — do not run the installer. The file was corrupted during download or is not the file we published. Delete it and download again; if a fresh download still doesn’t match, contact support.

Checksums and code signing

The checksum confirms integrity — that the bytes are exactly what we published. Omitly’s installers are also code-signed: the macOS (Apple silicon) app and DMG carry a Developer ID signature issued to Innisfallen Pty Ltd and are notarized by Apple, and the Windows installer is Authenticode-signed with a GlobalSign certificate that resolves as Publisher Innisfallen Pty Ltd. Your operating system checks the signature when you first run the app. The two are complementary: the checksum lets you confirm the file before you run it, and the code signature is your OS’s own check at launch.

This is different from verifying a redaction

Verifying your download and verifying a redacted PDF are separate things:

• A download checksum confirms the installer file is intact.
• A redaction certificate confirms that a redacted PDF had its content removed and hasn’t been altered since — see How to verify a redacted PDF.

They use similar hashing ideas but answer different questions.