How to Convert SHA256 to MD5 in PowerShell

I have seen this issue many times during file migrations and software deployments. An admin receives a SHA256 checksum from a vendor, but an older application or internal inventory process still expects an MD5 value.

The important detail is that you cannot truly convert a SHA256 hash into an MD5 hash. Hashes work in one direction. You must access the original file or original data, then calculate a new MD5 hash from it.

In this PowerShell tutorial, I will show you how to calculate MD5 and SHA256 hashes for the same file, verify them safely, and export results for a practical file-server workflow.

Can You Convert SHA256 to MD5 in PowerShell?

No, you cannot mathematically convert SHA256 to MD5 in PowerShell or any other tool. A hash is a fixed-length fingerprint created from the original file contents.

SHA256 produces a 256-bit hash value, while MD5 produces a 128-bit value. Each algorithm processes the original bytes differently, so a SHA256 value does not contain enough information to recreate the MD5 value.

For example, this SHA256 hash alone is not enough to produce an MD5 hash:

A1B2C3D4...

You need the original file, such as an installer, backup archive, log bundle, or document. Once you have the file, PowerShell can calculate both values with the built-in Get-FileHash cmdlet.

In a small company file-server environment, I often use this approach when validating a copied installer archive. I calculate SHA256 for modern integrity checks and MD5 only when a legacy application requires it.

Convert SHA256 to MD5 in PowerShell From a File

The correct way to convert SHA256 to MD5 in PowerShell is to calculate MD5 again from the same source file.

Let us say you copied an installer to this folder:

C:\FileServer\Software\ContosoAppSetup.exe

Run the following command:

Get-FileHash -Path "C:\FileServer\Software\ContosoAppSetup.exe" -Algorithm MD5

You will receive output similar to this:

Algorithm       Hash                             Path
---------       ----                             ----
MD5             5D41402ABC4B2A76B9719D911017C592 C:\FileServer\Software\ContosoAppSetup.exe

Here is what each part does:

• Get-FileHash is a PowerShell cmdlet, which is a built-in command that follows the verb-noun naming pattern.
• The -Path parameter tells PowerShell which file to read.
• The -Algorithm MD5 parameter tells PowerShell to calculate an MD5 checksum instead of the default SHA256 checksum.
• PowerShell reads the file bytes and returns the calculated hash value.

You do not need to install a module for this command. It works in Windows PowerShell 5.1 and PowerShell 7 on supported Windows systems.

If you need help working with file paths before hashing, read this guide on getting the absolute path of a directory.

Calculate SHA256 and MD5 Together

When you manage software packages, backups, or migrated files, I recommend calculating both hashes in the same script. It saves time and gives you a simple audit record.

Use this script:

$filePath = "C:\FileServer\Software\ContosoAppSetup.exe"

$sha256Hash = Get-FileHash -Path $filePath -Algorithm SHA256
$md5Hash = Get-FileHash -Path $filePath -Algorithm MD5

[PSCustomObject]@{
    FileName = Split-Path -Path $filePath -Leaf
    FilePath = $filePath
    SHA256   = $sha256Hash.Hash
    MD5      = $md5Hash.Hash
}

The script creates a variable named $filePath for the installer location. Keeping the file path in one variable makes the script easier to maintain.

The first Get-FileHash command calculates the SHA256 value. The second command reads the same file and calculates its MD5 value.

The [PSCustomObject] section creates a clean object with named properties. This is useful because PowerShell works best when you pass objects through the pipeline, which sends command output to the next command.

The Split-Path cmdlet uses the -Leaf parameter to return only the file name. You will see ContosoAppSetup.exe instead of the full folder path.

Pro Tip: In my experience, checksum mismatches usually happen because someone hashed two different file copies. Always confirm the full path, file size, and last modified time before assuming the hash algorithm caused the issue.

Save Hash Results to a CSV File

A CSV file gives you a reusable record of checksums from a deployment or file migration. This helps when you need to verify files later without recalculating every source value manually.

Use this PowerShell script to create a CSV file:

$filePath = "C:\FileServer\Software\ContosoAppSetup.exe"
$outputPath = "C:\FileServer\Reports\FileHashes.csv"

$sha256Hash = Get-FileHash -Path $filePath -Algorithm SHA256
$md5Hash = Get-FileHash -Path $filePath -Algorithm MD5

[PSCustomObject]@{
    FileName    = Split-Path -Path $filePath -Leaf
    FilePath    = $filePath
    FileSizeMB  = [math]::Round((Get-Item $filePath).Length / 1MB, 2)
    SHA256      = $sha256Hash.Hash
    MD5         = $md5Hash.Hash
    CheckedDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
} | Export-Csv -Path $outputPath -NoTypeInformation

The Get-Item cmdlet gets the file object, including its Length property. The script divides that size by 1MB and rounds the result to two decimal places.

The Get-Date cmdlet records when you generated the hashes. This detail becomes useful when a file changes later and you need to identify which validation run produced the result.

Finally, Export-Csv writes the object to a CSV file. The -NoTypeInformation parameter prevents PowerShell from adding an unnecessary type-information line at the top of the file.

For more detail, see how to export an array to CSV in PowerShell and how to create CSV files with headers.

Hash Every File in a Folder

A real file-server task rarely involves only one file. You may need to create MD5 and SHA256 records for every installer in a software repository.

This script scans a folder and exports a checksum report:

$sourceFolder = "C:\FileServer\Software"
$outputPath = "C:\FileServer\Reports\SoftwareHashes.csv"

Get-ChildItem -Path $sourceFolder -File -Recurse | ForEach-Object {
    $sha256Hash = Get-FileHash -Path $_.FullName -Algorithm SHA256
    $md5Hash = Get-FileHash -Path $_.FullName -Algorithm MD5

    [PSCustomObject]@{
        FileName    = $_.Name
        FilePath    = $_.FullName
        FileSizeMB  = [math]::Round($_.Length / 1MB, 2)
        SHA256      = $sha256Hash.Hash
        MD5         = $md5Hash.Hash
        CheckedDate = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    }
} | Export-Csv -Path $outputPath -NoTypeInformation

Get-ChildItem lists files and folders. The -File parameter limits results to files, while -Recurse searches through subfolders.

The pipe character (|) creates a pipeline. It sends each file object to ForEach-Object, which runs the script block once for every file.

Inside the loop, $_ represents the current file. The $_ .FullName property provides the full path needed by Get-FileHash, and $_ .Length provides the file size.

For a closer look at folder scanning, see Get-ChildItem in PowerShell and this guide to getting all files in a directory.

Verify a Known Hash Value

After calculating hashes, you often need to compare your result with a known value from a vendor, a previous CSV report, or a secure internal repository.

Use this script to validate a SHA256 value:

$filePath = "C:\FileServer\Software\ContosoAppSetup.exe"
$expectedSHA256 = "PASTE_THE_EXPECTED_SHA256_HASH_HERE"

$actualSHA256 = (Get-FileHash -Path $filePath -Algorithm SHA256).Hash

if ($actualSHA256 -eq $expectedSHA256) {
    Write-Host "SHA256 hash matches." -ForegroundColor Green
}
else {
    Write-Host "SHA256 hash does not match." -ForegroundColor Red
}

The parentheses around Get-FileHash let you access the returned Hash property. The script stores that value in $actualSHA256.

The if statement checks whether the actual value equals the expected value. The -eq operator means “equals” in PowerShell.

You can use the same pattern for MD5:

$expectedMD5 = "PASTE_THE_EXPECTED_MD5_HASH_HERE"
$actualMD5 = (Get-FileHash -Path $filePath -Algorithm MD5).Hash

if ($actualMD5 -eq $expectedMD5) {
    Write-Host "MD5 hash matches." -ForegroundColor Green
}
else {
    Write-Host "MD5 hash does not match." -ForegroundColor Red
}

Use MD5 only when a legacy system explicitly requires it. For security-sensitive integrity verification, use SHA256 or a stronger approved algorithm.

Add Error Handling to the Script

Files can disappear, become locked, or sit on an unavailable network share. A production-ready PowerShell script should handle those problems without stopping the entire job.

This example uses Try/Catch, which is PowerShell’s error-handling structure:

$filePath = "C:\FileServer\Software\ContosoAppSetup.exe"

try {
    if (-not (Test-Path -Path $filePath -PathType Leaf)) {
        throw "The file does not exist: $filePath"
    }

    $sha256Hash = Get-FileHash -Path $filePath -Algorithm SHA256 -ErrorAction Stop
    $md5Hash = Get-FileHash -Path $filePath -Algorithm MD5 -ErrorAction Stop

    Write-Output "SHA256: $($sha256Hash.Hash)"
    Write-Output "MD5: $($md5Hash.Hash)"
}
catch {
    Write-Error "Could not calculate hashes. $($_.Exception.Message)"
}

Test-Path checks whether the target file exists. The -PathType Leaf parameter confirms that the path points to a file instead of a folder.

The throw keyword creates a clear error when the file does not exist. The -ErrorAction Stop parameter tells PowerShell to treat hashing errors as terminating errors, so the catch block can handle them.

Read more about using Try/Catch in PowerShell and logging error messages to a file with PowerShell Try/Catch.

Things to Keep in Mind

• Do not convert hash strings: A SHA256 hash string cannot become an MD5 hash. Always calculate MD5 from the original file or source data.
• Use SHA256 for security checks: MD5 has known collision weaknesses, so use it only for compatibility with old tools or existing records.
• Hash the exact file copy: Check the full path, file name, and size before comparing values across servers or shares.
• Expect large files to take time: Get-FileHash reads the entire file, so large ISO files, database backups, and archives need more processing time.
• Handle unavailable files: Use Test-Path, Try/Catch, and -ErrorAction Stop when scanning folders or network locations.
• Protect your reports: A hash report may reveal file names and network paths, so apply suitable file permissions to CSV output.

Frequently Asked Questions

You now know that converting SHA256 to MD5 in PowerShell means recalculating MD5 from the original file, not transforming one hash string into another. Start with one known file, verify the output carefully, and automate folder-wide reports once you trust the process. I hope you found this article helpful.

You May Also Like

• Get the MD5 hash of a file in PowerShell
• Check whether a file exists in PowerShell
• Save output to a file in PowerShell
• List scheduled tasks in PowerShell
• Set execution policy in PowerShell

Bijay Kumar

Bijay Kumar is an esteemed author and the mind behind PowerShellFAQs.com, where he shares his extensive knowledge and expertise in PowerShell, with a particular focus on SharePoint projects. Recognized for his contributions to the tech community, Bijay has been honored with the prestigious Microsoft MVP award. With over 15 years of experience in the software industry, he has a rich professional background, having worked with industry giants such as HP and TCS. His insights and guidance have made him a respected figure in the world of software development and administration. Read more.