Getting started
Verify your download
Check the file you downloaded against the published SHA-256 fingerprint, in one command.
Why bother#
The installer arrives over the internet, from a CDN, through whatever is between you and it. A fingerprint check is the difference between trusting that chain and verifying it. The download page prints the SHA-256 of the exact file it just sent you, with a copy button next to it.
On Windows#
Open PowerShell in your downloads folder and run this against the file you got — substitute your own filename:
Get-FileHash .\Pip_0.1.0_x64-setup.exe -Algorithm SHA256Compare the Hash column with the fingerprint on the download page. Case does not matter; every other character does.
On macOS#
In Terminal, from the folder holding the disk image:
shasum -a 256 Pip_0.1.0_aarch64.dmgIf they do not match#
Heads up
Do not run the installer. Delete it, download again from the download page, and check the new file. If a fresh download still does not match, stop and tell us — include the hash you got and roughly when you downloaded it. That is a report we want to receive quickly.
Did this page not answer it? Tell us what you were looking for — that is how Pip's documentation gets written.