How to Verify a File with a Checksum (SHA-256)
By OomTools Editorial Team1 min read
Published Reviewed
A checksum (hash) is a short fingerprint of a file. Change a single byte and the fingerprint changes completely. That's why software projects publish a SHA-256 next to a download: if the hash of your copy matches theirs, the file arrived intact and untampered.
How to verify
- Download the file and note the publisher's listed SHA-256.
- Compute the SHA-256 of your downloaded copy.
- Compare the two strings — they should match exactly (case-insensitive, 64 hex characters).
If they differ, don't run the file: re-download it, and make sure you're comparing the same algorithm.
Which algorithm?
| Algorithm | Digest | Use today |
|---|---|---|
| MD5 | 128-bit | Broken — casual, non-security checks only |
| SHA-1 | 160-bit | Deprecated for security |
| SHA-256 | 256-bit | Recommended for integrity and security |
MD5 and SHA-1 can be deliberately collided, so never rely on them to prove a file is safe. Prefer SHA-256.
Check any file in your browser
The File Hash Calculator computes SHA-256 (and others) locally with the Web Crypto API — your file never leaves your device.
Sources
Ready to do it?
Open the File Hash Calculator