How do you verify a downloaded file with SHA-256?
Compare file integrity safely against a publisher-provided SHA-256 checksum.
Calculate the downloaded file's SHA-256 digest and compare it character-for-character with a value the publisher supplied through a separate trusted channel. A match means the bytes are identical; it does not by itself prove that the publisher is trustworthy.
What changed in this update?
The difference between integrity and publisher identity was clarified.
What risk does a checksum reduce?
A checksum detects transfer corruption or bytes that differ from the expected file. If an attacker can change both the file and the published checksum, the comparison cannot establish authenticity.
How should values be compared?
Choose the file in the Hash and Checksum tool, calculate SHA-256, normalize the expected value to lowercase without spaces, and compare. One differing character means no match.
How is a signature different?
A digital signature helps verify the identity of the holder of a private key. A checksum only shows whether two file contents are the same.
Frequently asked questions
Is an MD5 checksum enough?
Prefer SHA-256 for new distribution workflows. MD5 collision resistance is insufficient for security use.
Does the file leave the browser?
QR64Code processes the file with `crypto.subtle.digest` in the browser and does not upload it.