How to Verify a Download with a SHA-256 Checksum

Compare the file, not its displayed contents

Select the downloaded binary exactly as received. Hashing a filename, copying text out of a document, or extracting an archive first computes a digest for something else. A browser file-checksum calculator reads the bytes and presents a hexadecimal result. Uppercase and lowercase hexadecimal digits represent the same digest; the byte sequence being hashed must still match exactly.

Interpret a mismatch before retrying blindly

Check the release version, operating system, architecture and packaging variant. A .zip and a .tar.gz of similar contents have different bytes and therefore different hashes. An error page downloaded under an archive filename also produces a valid digest for the wrong content. Confirm the final response and file size, then compare the relevant release artifact again.

Know the authenticity boundary

A matching checksum establishes agreement with the supplied expected digest. If an attacker can replace both the download and the expected value, that comparison alone does not establish the publisher’s identity. Use the release’s documented signature or trusted distribution process where authenticity matters. Our tool calculates SHA-256, SHA-384 and SHA-512 locally and can compare one expected hexadecimal digest without sending the file to a conversion service.

Worked example

1. Obtain the expected SHA-256 from the intended release.
2. Select the exact downloaded file.
3. Compare all 64 hexadecimal digits.
4. Investigate any mismatch before using the artifact.

Can a matching digest tell me who published a file?

A checksum alone does not prove publisher identity. Its trust comes from how the expected digest or signed release metadata was obtained.

Reference and further reading

Read the official documentation ↗