Downloads and Validation

Official ISO Sources

CachyOS ISO can be obtained from the following sources:

Verifying ISO Integrity with SHA256

Current ISO Version: 260124

SHA256 Hash: 0c070fba1eb06a740983e8e195ecb686c4fc2060920137af1cedbd5ffca5be47

Download the file containing the SHA256 hash (Open it with a text editor, e.g., Notepad).
Open CMD or PowerShell as Administrator and navigate to the path where the ISO and SHA256 files are stored.

Execute the following command:

# Example:
certUtil -hashfile cachyos-desktop-linux-260124.iso SHA256

Compare the certUtil hash output to the one from the downloaded file in Step 1. If they match, you may proceed with the CachyOS installation.

Download the file containing the SHA256 hash.

Open a terminal, navigate to the directory containing the .sha256 file, and execute the following commands:

# Example:
cd ~/Downloads
cat cachyos-desktop-linux-260124.iso.sha256
# 0c070fba1eb06a740983e8e195ecb686c4fc2060920137af1cedbd5ffca5be47

Compare the output from Step 2 to the ISO file’s hash:
Terminal window
```
# Example:
sha256sum cachyos-desktop-linux-260124.iso
```
If the hashes from Step 2 and Step 3 match, you may proceed with the CachyOS installation.

Download the file containing the SHA256 hash.

Open a terminal, navigate to the directory containing the .sha256 file, and execute the following commands:

# Example:
cd Downloads/
cat cachyos-desktop-linux-260124.iso.sha256
# 0c070fba1eb06a740983e8e195ecb686c4fc2060920137af1cedbd5ffca5be47

Compare the output from Step 2 to the ISO file’s hash:
Terminal window
```
# Example:
shasum -a 256 cachyos-desktop-linux-260124.iso
```
If the hashes from Step 2 and Step 3 match, you may proceed with the CachyOS installation.

Verify ISO Image Authenticity (Linux)

To verify the authenticity of the ISO file:

Import the GPG key as a reference to compare against:

gpg --keyserver hkps://keys.openpgp.org --recv-key F3B607488DB35A47

Download the ISO file and its .sig signature file and run the following command (replace full_iso_name.iso with the actual ISO filename):

gpg --verify full_iso_name.iso.sig full_iso_name.iso

If you get a Good signature output, the ISO file is genuine:

gpg: Signature made sáb 24 ene 2026 12:16:37 -03
gpg:                using RSA key 882DCFE48E2051D48E2562ABF3B607488DB35A47
gpg: Good signature from "CachyOS <admin@cachyos.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 882D CFE4 8E20 51D4 8E25  62AB F3B6 0748 8DB3 5A47