SHA256 Generator From File: Checksums for Any Download

The command everywhere

sha256sum release.tar.gz         # Linux
shasum -a 256 release.tar.gz     # macOS
Get-FileHash release.zip         # Windows PowerShell (SHA-256 default)
certutil -hashfile release.zip SHA256   # Windows, older

No download is required on any of them — Get-FileHash has shipped since Windows 8. Fetching a "SHA256 calculator" executable from an unfamiliar site trades a built-in tool for an unknown binary, which is a poor bargain.

In the browser

Drop the file into the generator and it is hashed locally via the Web Crypto API. Nothing is uploaded, which matters for internal artifacts and signed builds.

The result is byte-for-byte the same as the command line, since both hash the raw bytes with no transformation. Memory is the practical limit — for very large files use the terminal.

Recording and re-checking

Checksum files let you snapshot a directory and verify it later, which is how backups and release artifacts are usually validated:

sha256sum *.tar.gz > SHA256SUMS   # record
sha256sum -c SHA256SUMS           # verify, non-zero exit on mismatch

The exit code makes it usable directly as a CI gate. Keep the checksum file somewhere the artifact publisher cannot silently rewrite, or the check proves nothing about authenticity.