SHA-256 File Checksum

Free SHA-256 file checksum tool

Here is the short version: hash the file you downloaded and compare it to the hex the vendor published. If they differ, do not run the installer. This SHA-256 file checksum tool does that in your browser. The file is not uploaded.

NIST defines the algorithm in FIPS 180-4, the Secure Hash Standard. Microsoft’s workstation command is Get-FileHash, which defaults to SHA-256. This page uses the same family of functions through the W3C Web Cryptography API.

Use it before you run an unknown installer, after you copy an ISO, or when two folders should hold the same build. Pair it with managed help desk so staff have a place to send “does this hash look right?”

How a checksum actually helps

A filename is a label. Setup.exe can be anything. A SHA-256 digest is a fingerprint of the bytes. Vendors put that fingerprint on the download page or in a SHA256SUMS file so you are not trusting the CDN hop, the email attachment, or the USB stick.

A match answers one question: are these the same bytes the publisher hashed? It does not answer “is the publisher honest” or “is this malware.” A criminal can hash their own trojan and print the digest next to the download.

That is still useful. Most bad installers in a small office are the wrong file, a truncated download, or a lookalike site. The phishing email checker is for the message that sent you the link. This page is for the file you then saved.

What this page computes

The compare step strips spaces, colons, and a leading 0x, then compares hex case-insensitively. That matches how people paste from PDF catalogs and from Get-FileHash output.

Text mode hashes the UTF-8 bytes of what you type. That is handy for checking a short string against a documented sample. It is the wrong tool for storing passwords.

Worked sample (the button loads this)

Text: Hello world
Algorithm: SHA-256
Expected: 64ec88ca00b268e5ba1a35678a1b5316d212f4f366b2477232534a8aeca37f3c

That is the same digest Microsoft shows in the Get-FileHash documentation for that string. Expect Match. Change one letter and the hex will not look close. That is the point of a cryptographic hash.

On a workstation, the same check is:

Get-FileHash .\\Setup.exe -Algorithm SHA256

or sha256sum Setup.exe on macOS and Linux. Use those for multi-gigabyte ISOs. This page reads the whole file into memory. It will refuse files over 150 MB and warn above 80 MB so a phone does not freeze.

Reading a SHA256SUMS file and certutil

Vendors often ship a text file next to the download. Each line is hex filename. Hash the file you have, then search the text file for that hex. If the hex is there and the filename matches, you have that build. If the hex is missing, stop.

Windows also has certutil -hashfile Setup.exe SHA256 (certutil). It prints the same digest with spaces between bytes. Paste that here. This tool ignores the spaces.

macOS: shasum -a 256 Setup.exe. Linux: sha256sum Setup.exe. All three should agree with this page on the same bytes.

Empty file SHA-256 is e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. If you see that, you hashed nothing. Useful when a download created a 0-byte stub.

When offices actually use this

A partner emails an “updated camera client.” A vendor USB arrives at reception. Someone copies an ISO from a laptop to a server. Those are the three jobs. The hash is the cheap check before the file becomes “the official installer” on a share.

It is also how you prove two backups of a legal export are the same bytes, without opening the archive. Hash both files. If the hex matches, the copies match.

Do not email the file to yourself “to check it.” That creates a second copy in mail. Hash it where it sits.

Mistakes that create a fake mismatch

• You hashed the .zip and the vendor hashed the .msi inside it.
• You compared a SHA-256 digest to an MD5 or SHA-1 line.
• The text file grew a Windows CRLF on one side and a Unix LF on the other.
• The download stopped at 99 percent. The hash will not be “almost right.” It will be wrong.
• You copied a truncated hash from a screenshot.

If the vendor only published MD5, treat that as a weak check. This tool does not offer MD5 on purpose. A two-minute hash is cheaper than rebuilding a PC.

What a collision story does not change

You will see claims that “hashes can collide.” For SHA-1 that is a real research result. For SHA-256, nobody has shown a practical collision on ordinary files. That is why vendors moved. This page still offers SHA-1 so you can read an old list. It labels that choice as legacy.

A more common failure is the wrong file, not a collision. People hash Setup (1).exe from Downloads and compare it to the digest for Setup.iso.

What this checksum tool is not

It is not VirusTotal. It does not look up the hash in a malware set. It will not tell you the publisher is real. It will not hash a 4 GB Windows ISO without locking the tab. It will not see that micros0ft-setup.com is a lookalike. Read the URL first.

It is also not a substitute for application allow-listing or a signed package policy. A hash check is the two-minute gate. Cybersecurity is the control that stops the next unsigned binary from running as admin.

Offices download remote-support tools, camera software, and “updated QuickBooks” files every week. The ones that get hurt run the file because the icon looked right.

If you want cybersecurity controls so staff cannot run random installers, contact Secure Techies.