How to Check a File Checksum (SHA-256, MD5): Confirming a Download Is Untouched

You have downloaded a large program, and on the download page there is a small line with a string of sixty-four or more characters labelled SHA-256. Nobody tells you why it is there. It is the answer to a simple question: is the file that reached my machine exactly the one the publisher uploaded, byte for byte? If a single character changed in transit, or someone tampered with it, the string will be completely different.

What a hash is

A hash function takes any input — a one-word text or a multi-gigabyte file — and outputs a fixed-length string. These functions are built to guarantee two things:

• Determinism: the same input always gives the same hash, on any machine, at any time.
• Sensitivity: changing one character changes the whole hash drastically, so two similar files never produce similar hashes.

It is also not practical to go from the hash back to the file. It is a one-way street: computed from the file, never the file recovered from it.

How to verify a download

1. Find the published checksum on the download page, and note which algorithm is written next to it (usually SHA-256).
2. Open Sahel's hash generator and choose the file. The calculation runs on your device and the file is never uploaded anywhere.
3. Look at that same algorithm in the results and compare the two values.
4. If they match character for character, the file is intact. If they differ in even one position, do not open it — download it again.

One detail matters: compare on the same algorithm. The MD5 hash of a file will never equal its SHA-256 hash, and that does not mean the file is damaged.

Which algorithm should you pick?

The tool offers MD5, SHA-1, SHA-256, SHA-384 and SHA-512. The working rule is simple:

• SHA-256 or higher for anything touching security, signatures, or verifying a download from a source you do not fully trust.
• MD5 and SHA-1 only when a legacy system or a publisher dictates it, or when you just want to spot accidental corruption in a copy of a file.

A plain warning: do not use MD5 or SHA-1 to store passwords or sign sensitive data. They are no longer considered safe for that, and researchers have shown it is possible to construct two different inputs with the same hash. For passwords, use functions designed for the job, which are slow on purpose.

Common mistakes when comparing

Most reported "mismatches" are not real corruption but small slips in the comparison itself:

• Letter case: a hash is written in hexadecimal, and some sites show it in capitals and others in lower case. The two values are identical despite looking different.
• A stray space or newline: copying a hash from a web page can drag a blank along at the start or end, and an automated comparison then fails.
• The wrong release: a page may still publish the previous version's hash, so you are checking a good file against a stale value.
• Hashing text instead of a file: the hash of a typed file name is not the hash of its contents. Make sure you chose the file itself.

The safe rule: if the values still differ once those causes are ruled out, downloading again comes first, not opening the file to see what happens.

A realistic scenario

A systems administrator downloads an operating system image several gigabytes in size over a slow, unreliable connection. Once it finishes, they want to be sure before burning it to disc or installing it on dozens of machines. They compute its SHA-256 and compare it with the value on the publisher's page, and it differs in the last eight characters. The cause was an interruption mid-download that left the file short without anyone complaining. They download it again and the two hashes match. Without that step, the fault would have surfaced later, on a customer's machine rather than their own.

And if what you actually need is a strong password rather than a hash of an existing one, use the password generator.

Frequently asked questions

Is my file uploaded to a server?

No. The calculation happens on your device and neither the file nor its contents are sent anywhere. That matters when you are checking work files or backups.

Does a hash encrypt the file?

No. It neither hides nor protects the contents; it gives them a stable identifier. Anyone with the file can compute its hash, and anyone with only the hash cannot recover the file.

Why is the hash of empty text not empty?

Because the function works on any input, including an empty one, and gives it a specific known hash. It is one of the cases commonly used to confirm a tool is working correctly.

Does the hash change if I rename the file?

No. The hash is computed from the file's contents only, not its name or date. Editing and re-saving a file, though, even with no visible change, can alter internal bytes and change the hash.

What is the difference between a checksum and a digital signature?

A checksum proves the file is unchanged against a known value, but not who published that value. If the page showing the hash were compromised, the hash could be swapped along with the file. A digital signature supplies the missing piece by tying the file to the publisher's key.