A SHA-256 check compares the downloaded file's bytes with an expected digest. A match is strong evidence that the bytes agree with that value. It does not scan for malware, validate the file's contents or establish who published it.
Find the expected value and its source
Use the publisher's documented release information. A digest beside a download helps detect accidental corruption, incomplete transfers and different mirror copies. If an attacker can replace both the file and that page, they can replace the digest too.
A publisher signature verified with a separately trusted key offers stronger provenance than an unsigned digest alone. Follow that publisher's verification procedure when one is available. Do not treat an unverified forwarded message as an independent trusted source.
Hash the downloaded file itself
Open Hash and Checksum Generator. Choose A file from this device, select SHA-256, choose the file and enter the expected value. For expected-value comparison, use one file and one algorithm at a time. The tool also supports batches and an all-algorithm mode for other tasks.
Hash the archive if the published digest names the archive. An extracted member has different bytes from its containing ZIP. Renaming a file leaves its bytes unchanged; re-encoding an image or resaving a document can change them even if it looks the same.
A SHA-256 digest is 64 hexadecimal characters. The comparison ignores case, spaces and colons in the expected value. Check that you copied the digest rather than a filename, signature or digest for a different release.
Investigate a mismatch before using the file
Confirm the release name, algorithm and complete byte size. A matching size does not establish a matching file, but a smaller download can explain a mismatch. Download again from the documented location and repeat the check against the correct expected value.
If it still differs, stop and check the publisher's release information. Do not solve the warning by replacing the expected value with the one you just calculated. Keep the mismatch as evidence until you understand it.
Use an operating-system tool for larger files
The browser tool allows text up to 5,000,000 characters or up to 20 files totalling 64 MiB. SHA-2 requires the browser's Web Crypto interface. If it is unavailable, use a supported browser or another SHA-256 implementation; a legacy algorithm is not an equivalent security substitute.
For a larger archive named release.zip, these commands request SHA-256 explicitly:
Linux: sha256sum release.zip
Windows: Get-FileHash -Algorithm SHA256 release.zip
macOS: shasum -a 256 release.zip
The Windows example runs in PowerShell. Use the actual file path, quoting paths containing spaces. Compare the digest field, not the surrounding command output.
Keep algorithm and trust separate
MD5 and SHA-1 are available for matching legacy checksum records; CRC32 is for accidental-corruption checks. Prefer the algorithm the trusted publisher specifies, and use a modern cryptographic digest for new security-sensitive integrity checks. The SHA-2 algorithms are defined in NIST's Secure Hash Standard.
A correctly matching file can still contain a broken or malicious program. Check the publisher and release provenance as well as the digest, and use the software's normal security and installation checks before running it.