How to verify a Minecraft server jar
Updated · MCJarHub
Compute the file's checksum on your computer and compare it with the value shown on the MCJarHub page (and, where it exists, the upstream's own page). If a single character differs, do not run the file.
1. Get the expected value
Open the version page for your file and copy the SHA-256 from the download box (use the copy button). Where the upstream publishes its own checksum — for example PaperMC's build pages or a GitHub release — you can compare against that too.
2. Compute the checksum of your file
Windows (PowerShell)
Get-FileHash .\server.jar -Algorithm SHA256
Windows (Command Prompt)
certutil -hashfile server.jar SHA256
Linux
sha256sum server.jar
macOS
shasum -a 256 server.jar
For a SHA-1 (Mojang files) use -Algorithm SHA1, certutil -hashfile server.jar SHA1, sha1sum or shasum -a 1. For MD5 (Purpur): -Algorithm MD5, md5sum or md5 on macOS.
3. Compare — let the computer do it
Comparing 64 characters by eye is error-prone. On Linux you can let sha256sum check it (two spaces between hash and file name):
echo "PASTE_SHA256_HERE server.jar" | sha256sum -c -
In PowerShell:
(Get-FileHash .\server.jar -Algorithm SHA256).Hash -eq "PASTE_SHA256_HERE".ToUpper()
You can also paste a hash into the jar hash lookup to see which software, version and build it belongs to.
Warning signs of a tampered jar
- The checksum does not match the value on the download page or the upstream.
- The file size is very different from the size shown on the page.
- You got it from a Discord DM, a video description or a "cracked"/"premium unlocked" site instead of the project or a page that names its source.
- It asks for administrator rights, or an antivirus flags it — server jars never need admin rights.
- For Spigot/CraftBukkit, the safest option is always to build it yourself with BuildTools.