LocalOps Studio free browser tools

How-to guide · HashVault

How to verify a file download with SHA-256

A checksum next to a download link is the cheapest integrity guarantee on the internet: hash the file you received, compare with the published value, and you know the transfer was not corrupted or swapped. Here is how to do it.

Updated 2026-08-23 Local-first No upload

What a checksum is and why it matters

A SHA-256 checksum is a fixed-length fingerprint computed from a file's contents. Change one byte and the fingerprint changes completely. When a publisher ships a checksum alongside a download, it gives you a way to prove the file you got is exactly the file they published.

This matters for software installers, firmware images, large datasets, and anything you cannot re-download casually.

How to generate and compare a checksum

  1. Download the file and also copy the published checksum from the website.
  2. Open a local hashing tool like HashVault and drop the downloaded file on it.
  3. Read the generated SHA-256 value and compare it with the published one.
  4. If they match, the download is intact. If not, delete the file and download again from the official source.

Shipping a checksum manifest with your own release

Releasing an archive, firmware, or dataset? Generate a manifest - one hash and filename per line - and publish it next to the files. Anyone can verify every file in the release against the manifest in one pass.

The manifest should be plain text so it can be diffed, signed, or pasted anywhere.

Checksums, not security theater

A checksum confirms integrity - the file did not change in transit. It does not by itself prove authenticity; for that, combine it with the publisher's signature or TLS-secured download. But as a first-line integrity check, it catches corruption and tampering far more often than people expect.

Try it free - HashVault

Hash files and generate checksums locally

Open the tool

Frequently asked questions

What does a SHA-256 checksum look like?

A 64-character hexadecimal string, for example a lowercase sequence of letters and digits. Any change in the file changes this string entirely.

Are files uploaded to compute the hash?

Not necessarily. Browser tools like HashVault stream the file through the hashing function locally, so nothing is transmitted.

What is a checksum manifest?

A plain text file with one hash and filename per line, in the same layout the sha256sum command line tool uses, so standard tooling can verify it.

Can I hash text as well as files?

Yes. Paste text to hash it directly, or mix files and text - the manifest covers whatever you loaded.