Apt-Get Hash Sum Mismatch: The Real Fixes

What's Actually Happening Here

You run sudo apt-get update and halfway through it barfs: Hash Sum Mismatch. The package index file you downloaded doesn't match what the server said it would be. Maybe the file got corrupted during download. Maybe your ISP is rewriting packets (yes, that happens). Maybe the mirror you're hitting is out of sync.

The error looks like this:

W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/InRelease  Hash Sum mismatch
E: Some index files failed to download. They have been ignored, or old ones used instead.

The key thing: this is almost never a filesystem corruption. It's a network or proxy problem. Let's fix it.

Fix 1: Clear the Cache (30 Seconds)

The fastest thing to try — and honestly it works 60% of the time — is to wipe the downloaded index files and let apt get fresh ones.

sudo rm -rf /var/lib/apt/lists/*
sudo apt-get update

Why this works: the old partial or corrupted index files are gone. Apt downloads them again from scratch. If your network connection was just flaky during the last attempt, this fixes it.

If that didn't work, move on.

Fix 2: Switch to a Different Mirror (2 Minutes)

The mirror you're hitting might be stale or serving mismatched files. This happens a lot with the default archive.ubuntu.com during peak hours.

Edit your sources file:

sudo nano /etc/apt/sources.list

Replace the main archive URL with a reliable mirror. For Ubuntu, use http://us.archive.ubuntu.com/ubuntu/ or pick one from Ubuntu's mirror list. For Debian, try http://deb.debian.org/debian/.

After you change it, run:

sudo apt-get update

If it still fails, the issue is probably on your side.

Fix 3: Check Your Proxy or ISP (5 Minutes)

Here's the one nobody checks first: your proxy or ISP might be caching or modifying the apt files. Some ISPs inject tracking headers or use transparent proxies that corrupt the files.

Check if you're using a proxy:

echo $http_proxy
echo $https_proxy

If either returns something, your system is routing through a proxy. Try temporarily bypassing it:

unset http_proxy
unset https_proxy
sudo apt-get update

If that works, you need to either configure the proxy to pass through apt traffic correctly, or set Acquire::http::Pipeline-Depth 0 in /etc/apt/apt.conf.d/99proxy-pipeline. Actually, just create that file with:

Acquire::http::Pipeline-Depth 0;
Acquire::http::No-Cache true;
Acquire::http::Timeout 30;

This tells apt to not pipeline requests and disable caching — effectively working around broken proxies.

Fix 4: Check DNS and IPv6 (10 Minutes)

Sometimes IPv6 is the culprit. If your network has flaky IPv6, apt might get responses from different servers over IPv4 vs IPv6, and the hashes don't match.

Force apt to use IPv4 only:

sudo apt-get -o Acquire::ForceIPv4=true update

If this works, you can make it permanent by adding this line to /etc/apt/apt.conf.d/99force-ipv4:

Acquire::ForceIPv4 "true";

Also check DNS — if your DNS server returns different IPs on each query (round-robin), you might hit different mirrors each time. Use nslookup archive.ubuntu.com and see if the IP changes when you run it again. If it does, switch to a static mirror (Fix 2).

Fix 5: The Nuclear Option — Change to HTTPS (15 Minutes)

If nothing else works, switch your apt sources from HTTP to HTTPS. This stops any middle-man meddling (proxy, ISP, etc.). The files are encrypted end-to-end, so no tampering.

First, install the apt transport for HTTPS:

sudo apt install apt-transport-https ca-certificates

Then edit /etc/apt/sources.list and replace all http:// with https://. For Ubuntu, it becomes:

deb https://archive.ubuntu.com/ubuntu/ focal main restricted
# etc.

Then clear the cache and update:

sudo rm -rf /var/lib/apt/lists/*
sudo apt-get update

This is the most reliable fix. I use it on all my servers now. The reason: even if your ISP proxies HTTPS, they can't rewrite the content without breaking the TLS handshake. Apt gets the exact file the repo sent.

When None of This Works

If you've tried all five and still get hash mismatches, check your system time. Seriously. If your clock is more than a few minutes off, the GPG signature check on the InRelease file fails, and apt shows a hash mismatch. Fix with:

sudo timedatectl set-ntp true
sudo hwclock --systohc
sudo apt-get update

That's the edge case, but it happens. Especially on Raspberry Pis without a battery-backed clock.

One last thing: if you're running an old Ubuntu release (like 18.04) that's EOL, the repositories might have moved to old-releases.ubuntu.com. Update your sources to point there. The standard repos return garbage for EOL releases.