Worked tutorial

Verify a download with a SHA-256 checksum

Learn how hashes detect changed bytes and why matching hashes do not establish safety.

NowConverter field lesson · Updated 19 October 2026 · Examples use our original test files.

Why hashes are useful

When a software publisher provides a SHA-256 value for a downloadable file, you can compute the hash of your copy and compare the exact hexadecimal string. A match means the bytes correspond to the bytes represented by that digest, subject to the security of the hash algorithm and the authenticity of the expected digest. It does not guarantee that the publisher or software is trustworthy.

Try an exact reproducible example

  1. Download sample-data.json from our sample library.
  2. Open Hash Checker, compute SHA-256 for that file and copy the full digest.
  3. Make a second local copy without modifications. Calculate the digest again; it should match exactly.
  4. Change one byte—for example, replace an ordinary letter in the JSON content—and save it as another file. Compute its SHA-256. The new digest should be different.

What to compare

Compare all 64 hexadecimal characters of the SHA-256 digest, not just the beginning. File names and extensions do not determine a hash; the exact file bytes do. Newlines, spaces and encoding can change the result even when the text looks almost identical.

Where should the expected hash come from?

For real software downloads, obtain the expected digest from a trustworthy publisher channel that is independent of your possibly modified download. If an attacker controls both the file and the webpage showing the hash, a matching value cannot protect you. Digital signatures, software supply-chain controls and malware scanning solve different problems.

Common mistakes

For important releases, record the expected source URL and publication date together with your hash comparison.