How to check a download's SHA-256 checksum in your browser

A checksum is a short fingerprint computed from a file's contents. If you hash the file you downloaded and the result matches the value the publisher lists, the file is byte for byte the one they hashed. If even one bit differs, the fingerprint changes completely. Drop the file into the hash generator, paste the published value, and the tool shows which algorithm matches.

What a checksum proves

A checksum detects change. It catches a download that stopped halfway, a file damaged by a flaky connection or a failing disk, and a mirror that serves a different build from the original. Those errors are common, and a matching hash rules them out.

It does not prove that the publisher is trustworthy. Suppose an attacker can change the file on a download page and also edit the hash shown next to it. The two match, and the check passes. A checksum is only as trustworthy as the place you got the hash from. For a meaningful check, the hash should come through a different channel from the file: a signed release announcement, a checksum file with a GPG signature, a package manager's records, or the publisher's site reached by typing its address yourself. A hash copied from the same link as the file adds little against a determined attacker.

A matching hash also says nothing about what the program does. It confirms you have the file the publisher hashed. Whether that file is safe is a question about the publisher, answered by the signature, the reputation of the source and the project's own verification steps, if it has them.

Where publishers list hashes

Look near the download button first. Many projects print the SHA-256 value on the download page. Larger projects often publish a file, commonly named SHA256SUMS or something similar, with one line per download, and sometimes a signature file beside it. Some software platforms carry hashes in their own metadata. The README and release notes are the other usual places.

Read the algorithm name too. A line that says SHA-256 needs a SHA-256 hash, which is 64 hexadecimal characters. A value of 32 characters is MD5, and 40 characters is SHA-1. The tool needs to know which one you are comparing, and so do you.

Compare the hash in four steps

1. Download the file once, from the official page.
2. Open the hash generator and drop the file in. Wait for it to finish. Very large files can take a while and may exceed what a browser can hold in memory.
3. Paste the published hash into the expected field. Case and spaces are ignored, so an uppercase value copied from a page works.
4. Look for the match. The tool shows which algorithm matches. If none does, do not run the file. Download it again. If the second copy also fails, the published value and your file disagree, and you should ask the publisher which one is correct.

If you prefer a terminal, the same check takes one command. On Linux, run sha256sum on the file. On macOS, shasum -a 256 does the same. In Windows PowerShell, Get-FileHash -Algorithm SHA256 with the file path gives the value. The output is the same hexadecimal string the tool shows.

Hashing typed text

The tool also hashes text you type. It converts the text to UTF-8 bytes before hashing, so two texts that look identical can have different hashes if their line endings differ. A file saved on Windows usually ends each line with CRLF, while Linux and macOS use LF. The two files look the same but hash differently. This is the most common reason a text hash does not match an expected value. If you need to see exactly where two versions differ, the compare text tool shows the changes side by side.

Why MD5 and SHA-1 are weak

The tool offers MD5 and SHA-1 because many older download pages still list them. For spotting corruption, they are fine. An accidental change is extremely unlikely to produce a matching MD5 or SHA-1 value by chance.

Against an attacker, they are not. A collision is two different inputs with the same hash. MD5 collisions can now be produced cheaply, so no security use should rely on MD5. A SHA-1 collision was publicly demonstrated in 2017, and browsers and certificate authorities have since retired SHA-1 for signatures. If a publisher offers only MD5 or SHA-1, ask for SHA-256 or a signed checksum file. For anything where someone might deliberately tamper with the file, use SHA-256 or stronger. No known practical attack breaks SHA-256 at the time of writing.

Quick answers

Does a matching hash mean the file is safe? It means the file is the one that was hashed. Safety depends on whether the hash came from a source you trust.

Can two different files have the same SHA-256? Not in practice. No practical method for finding such a pair is known at the time of writing.

Why does my hash not match after I copied it? Check the algorithm first. Then look for a missing or extra character, or a truncated copy. Case and spaces are ignored, so they are not the cause.