Hash generator · Guide
SHA256 Hash Checker: Verify a Checksum Correctly
Checking a SHA-256 is comparing two strings — but a surprising number of failed checks come down to how the comparison was done rather than a genuinely bad file. Here is the reliable procedure.
The check itself
Compute the digest of what you have and compare it to the published value. Case does not matter, whitespace does — trim both sides before comparing, and compare the entire 64 characters rather than eyeballing the first few.
On the command line the tools verify for you and set an exit code, which is what you want inside a script:
# verify against a checksum file
sha256sum -c SHA256SUMS
# verify a single value
echo "<expected> installer.iso" | sha256sum -c -Checking text rather than files
Text checks fail most often because of an invisible trailing newline. echo adds one; printf %s does not. Our checker hashes exactly the characters you paste, with no newline appended, matching the printf form.
Encoding matters too: the digest covers bytes, so the same visible text in UTF-8 and UTF-16 gives different results. We always use UTF-8, which is what nearly every runtime and database does.
When a check fails
Compare file sizes first — a truncated download is the most common cause and takes a second to rule out. Then confirm the algorithm: publishers often list SHA-256 and MD5 side by side, and it is easy to compare against the wrong one. A 64-character expected value is SHA-256; 32 is MD5.
If sizes match and the algorithm is right, treat the file as untrustworthy and fetch it again from the primary source rather than a mirror.
Frequently asked questions
Does the checker upload my file?
No. Hashing happens in your browser, so the file never leaves your machine.
Why does my text digest differ from the terminal?
Almost always a trailing newline added by echo. Use printf %s to match.
Is a matching SHA-256 proof the file is safe?
It proves the bytes match what was hashed. If the attacker controlled the published checksum too, it proves nothing — that requires a signature.
Ready to try it?
Open the free browser-based Hash generator and apply what you just read — no sign-up, runs locally.
Open the Hash generator tool